One read of Claude Developer Platformapi-20260930T233759Z
343 pages moved out of 740 read.
Pages moved
343
significant first
Pages read
740
in this capture
Captured
23:37 UTC
Corpus hash
1974d9bc7c5a
index-hash
What this read moved
101-125 of 343, page 5 of 14This capture is too large to show at once. Changes 101-125 of 343 are below, significant first; the rest are on the following screens.
api/organization/federation/issuers/retrieve New page · 195 lines, new page
# Get Federation Issuer ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Get Federation Issuer
url: https://platform.claude.com/docs/en/api/organization/federation/issuers/retrieve
---
# Get Federation Issuer
**GET** `/v1/organizations/federation_issuers/{federation_issuer_id}`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Retrieve a federation issuer by its ID (`fdis_...`).
## Path parameters
- `federation_issuer_id: string`
ID of the federation issuer.
## Returns
- `FederationIssuer object`
Registered external OIDC identity provider.
Records an external IdP the organization trusts for the RFC 7523
jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
- `type: "federation_issuer"`
default: federation_issuer
- `id: string`
Tagged ID of the federation issuer.
- `archived_at: string or null`
If set, all rules referencing this issuer reject token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
- `check_jti: boolean`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `created_at: string`
When this issuer was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
- `issuer_url: string`
The `iss` claim value. Incoming JWTs must match exactly.
- `jwks: JWKSDiscovery or JWKSExplicitURL or JWKSInline`
How signing keys are obtained for signature verification.
- `JWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `JWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `JWKSInline object`
JWKS supplied directly; no network fetch.
- `type: "inline"`
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `jwks_polling_disabled_at: string or null`
If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
format: date-time
- `max_jwt_lifetime_seconds: number`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
- `name: string`
Admin-chosen slug identifier.
- `poll_status: FederationIssuerPollStatus or null`
Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.
- `consecutive_failures: number`
Consecutive fetch failures since the last success.
- `last_fetched_at: string or null`
When the last successful fetch completed.
format: date-time
- `next_poll_at: string or null`
When the next fetch is scheduled. Null if paused.
format: date-time
- `updated_at: string`
When this issuer was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"check_jti": true,
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"issuer_url": "https://token.actions.githubusercontent.com",
"jwks": {
"type": "discovery",
"ca_cert_pem": "ca_cert_pem",
"discovery_base": "discovery_base"
},
"jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
"max_jwt_lifetime_seconds": 0,
"name": "github-actions",
"poll_status": {
"consecutive_failures": 0,
"last_fetched_at": "2019-12-27T18:11:19.117Z",
"next_poll_at": "2019-12-27T18:11:19.117Z"
},
"type": "federation_issuer",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
api/organization/federation/issuers/update New page · 282 lines, new page
# Update Federation Issuer ## Path parameters ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Update Federation Issuer
url: https://platform.claude.com/docs/en/api/organization/federation/issuers/update
---
# Update Federation Issuer
**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Partially update a federation issuer.
Setting `jwks` replaces the full JWKS shape at once. Archived issuers
cannot be updated; this returns 400. Create a new issuer instead.
Updating an issuer that backs a rule with a scope outside
`workspace:developer` or `workspace:inference` requires a Console
session.
## Path parameters
- `federation_issuer_id: string`
ID of the federation issuer to update.
## Body parameters
- `check_jti: optional boolean or null`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `issuer_url: optional string or null`
Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity.
minLength: 1
- `jwks: optional JWKSDiscovery or JWKSExplicitURL or JWKSInline or null`
Replaces the entire JWKS configuration.
- `JWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `JWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `JWKSInline object`
JWKS supplied directly; no network fetch.
- `type: "inline"`
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `jwks_polling_disabled: optional boolean or null`
Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected.
- `max_jwt_lifetime_seconds: optional number or null`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
minimum: 1, maximum: 176400
- `name: optional string or null`
Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
minLength: 1, maxLength: 255
## Returns
- `FederationIssuer object`
Registered external OIDC identity provider.
Records an external IdP the organization trusts for the RFC 7523
jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
- `type: "federation_issuer"`
default: federation_issuer
- `id: string`
Tagged ID of the federation issuer.
- `archived_at: string or null`
If set, all rules referencing this issuer reject token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.
- `check_jti: boolean`
Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.
- `created_at: string`
When this issuer was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this issuer.
- `issuer_url: string`
The `iss` claim value. Incoming JWTs must match exactly.
- `jwks: JWKSDiscovery or JWKSExplicitURL or JWKSInline`
How signing keys are obtained for signature verification.
- `JWKSDiscovery object`
JWKS via the issuer's OIDC discovery document.
- `type: "discovery"`
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `discovery_base: optional string or null`
Set when the discovery URL differs from `issuer_url`.
- `JWKSExplicitURL object`
JWKS fetched from a fixed endpoint.
- `type: "explicit_url"`
- `url: string`
JWKS endpoint.
minLength: 1
- `ca_cert_pem: optional string or null`
Optional custom CA (PEM) for TLS verification of the JWKS fetch.
maxLength: 8192
- `JWKSInline object`
JWKS supplied directly; no network fetch.
- `type: "inline"`
- `keys: array of map[unknown]`
Inline JWK objects.
minItems: 1
- `jwks_polling_disabled_at: string or null`
If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
format: date-time
- `max_jwt_lifetime_seconds: number`
Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
- `name: string`
Admin-chosen slug identifier.
- `poll_status: FederationIssuerPollStatus or null`
Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.
- `consecutive_failures: number`
Consecutive fetch failures since the last success.
- `last_fetched_at: string or null`
When the last successful fetch completed.
format: date-time
- `next_poll_at: string or null`
When the next fetch is scheduled. Null if paused.
format: date-time
- `updated_at: string`
When this issuer was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{}'
```
### Response (200)
```json
{
"id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"check_jti": true,
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"issuer_url": "https://token.actions.githubusercontent.com",
"jwks": {
"type": "discovery",
"ca_cert_pem": "ca_cert_pem",
"discovery_base": "discovery_base"
},
"jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
"max_jwt_lifetime_seconds": 0,
"name": "github-actions",
"poll_status": {
"consecutive_failures": 0,
"last_fetched_at": "2019-12-27T18:11:19.117Z",
"next_poll_at": "2019-12-27T18:11:19.117Z"
},
"type": "federation_issuer",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
api/organization/federation/rules New page · 1661 lines, new page
# Rules ## Create Federation Rule ### Body parameters ### Returns ### Example #### Response (200) ## List Federation Rules ### Query parameters ### Returns ### Example #### Response (200) ## Get Federation Rule ### Path parameters ### Returns ### Example #### Response (200) ## Update Federation Rule ### Path parameters ### Body parameters ### Returns ### Example #### Response (200) ## Archive Federation Rule ### Path parameters ### Returns ### Example #### Response (200) ## Domain types ### Federation Rule ### Federation Rule Match ### Federation Rule Workspace ### Service Account Target ## Rules › Workspaces ### Add Federation Rule Workspace #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### List Federation Rule Workspaces #### Path parameters #### Query parameters #### Returns #### Example ##### Response (200) ### Remove Federation Rule Workspace #### Path parameters #### Returns #### Example ##### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Rules
url: https://platform.claude.com/docs/en/api/organization/federation/rules
---
# Rules
## Create Federation Rule
**POST** `/v1/organizations/federation_rules`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Create a federation rule owned by your organization.
The referenced issuer and the target service account must already exist
in the same organization; invalid references are rejected with a 400
error. The workspace reference is validated. Membership is not checked
at rule creation: token exchange resolves a single enabled workspace per
call and is rejected unless the target service account is a member of
that workspace (it is implicitly a member of the default workspace).
Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite,
Terraform Cloud, Google) must constrain tenant identity via an
identity-bearing claim, a tenant-pinning subject prefix (such as
`repo:YOUR_ORG/...`), or a CEL condition referencing one of those
identity claims (e.g. `claims.repository_owner`). OAuth callers may only
manage rules whose `oauth_scope` is `workspace:developer` or
`workspace:inference`; other scopes require a Console session.
### Body parameters
- `issuer_id: string`
Tagged ID of the federation issuer.
- `match: FederationRuleMatch`
Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
maxLength: 1024
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
maxLength: 4096
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
maxLength: 1024
- `name: string`
Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
minLength: 1, maxLength: 255
- `oauth_scope: string`
Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
minLength: 1
- `target: ServiceAccountTarget`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `type: "service_account"`
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `applies_to_all_workspaces: optional boolean`
When true, enable this rule for every workspace in the org (including workspaces created later).
- `attributes: optional map[string] or null`
CEL expressions `{name: expr}` extracting named values from claims. Not yet supported; any non-empty value is rejected with 400.
- `description: optional string or null`
Optional free-text description.
maxLength: 2000
- `token_lifetime_seconds: optional number`
Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
minimum: 60, maximum: 86400
- `workspace_id: optional string or null`
Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.
### Returns
- `FederationRule object`
Authorization rule binding an external OIDC identity to Anthropic.
Evaluates the match conditions and mints an OAuth access token for the
resolved target, scoped to a single workspace where the rule is enabled
(chosen by the caller at exchange time when the rule is enabled for more
than one). For rules enabled via `workspace_ids` or
`applies_to_all_workspaces`, the target service account must be a member
of that workspace (it is implicitly a member of the default workspace);
rules carrying only the legacy `workspace_id` binding do not enforce
this.
- `type: "federation_rule"`
default: federation_rule
- `id: string`
Tagged ID of the federation rule.
- `applies_to_all_workspaces: boolean`
When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.
- `archived_at: string or null`
If set, this rule is archived and rejects token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
- `attributes: map[string] or null`
CEL expressions extracting named values from claims. Not yet supported; always null.
- `created_at: string`
When this rule was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this rule.
- `description: string or null`
Optional free-text description.
- `issuer_id: string`
Tagged ID of the issuer whose tokens this rule accepts.
- `issuer_name: string or null`
Issuer's display name at read time.
- `match: FederationRuleMatch`
Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
maxLength: 1024
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
maxLength: 4096
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
maxLength: 1024
- `name: string`
Admin-chosen slug identifier.
- `oauth_scope: string`
Space-separated OAuth scopes granted on the minted token.
- `target: ServiceAccountTarget`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `type: "service_account"`
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `token_lifetime_seconds: number`
Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
- `updated_at: string`
When this rule was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
- `workspace_id: string or null`
Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.
- `workspace_ids: array of string`
Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
### Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_rules \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"issuer_id": "issuer_id",
"match": {},
"name": "x",
"oauth_scope": "x",
"target": {
"service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"type": "service_account"
}
}'
```
#### Response (200)
```json
{
"id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
"applies_to_all_workspaces": true,
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"attributes": {
"foo": "string"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"issuer_id": "issuer_id",
"issuer_name": "issuer_name",
"match": {
"audience": "audience",
"claims": {
"foo": "string"
},
"condition": "condition",
"subject_prefix": "subject_prefix"
},
"name": "prod-deploy-pipeline",
"oauth_scope": "oauth_scope",
"target": {
"service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"type": "service_account",
"service_account_name": "service_account_name"
},
"token_lifetime_seconds": 0,
"type": "federation_rule",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id",
"workspace_id": "workspace_id",
"workspace_ids": [
Cut at 300 lines. The page has the rest.
api/organization/federation/rules/archive New page · 210 lines, new page
# Archive Federation Rule ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Archive Federation Rule
url: https://platform.claude.com/docs/en/api/organization/federation/rules/archive
---
# Archive Federation Rule
**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Archive a federation rule.
Token exchange through this rule stops immediately. Idempotent;
re-archiving returns the rule with its original `archived_at`. Archiving
clears the rule's workspace targeting (`workspace_id` and
`workspace_ids` are emptied). Tokens already minted before archive
remain valid until they expire. OAuth callers may only manage rules
whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
other scopes require a Console session.
## Path parameters
- `federation_rule_id: string`
ID of the federation rule to archive.
## Returns
- `FederationRule object`
Authorization rule binding an external OIDC identity to Anthropic.
Evaluates the match conditions and mints an OAuth access token for the
resolved target, scoped to a single workspace where the rule is enabled
(chosen by the caller at exchange time when the rule is enabled for more
than one). For rules enabled via `workspace_ids` or
`applies_to_all_workspaces`, the target service account must be a member
of that workspace (it is implicitly a member of the default workspace);
rules carrying only the legacy `workspace_id` binding do not enforce
this.
- `type: "federation_rule"`
default: federation_rule
- `id: string`
Tagged ID of the federation rule.
- `applies_to_all_workspaces: boolean`
When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.
- `archived_at: string or null`
If set, this rule is archived and rejects token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
- `attributes: map[string] or null`
CEL expressions extracting named values from claims. Not yet supported; always null.
- `created_at: string`
When this rule was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this rule.
- `description: string or null`
Optional free-text description.
- `issuer_id: string`
Tagged ID of the issuer whose tokens this rule accepts.
- `issuer_name: string or null`
Issuer's display name at read time.
- `match: FederationRuleMatch`
Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
maxLength: 1024
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
maxLength: 4096
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
maxLength: 1024
- `name: string`
Admin-chosen slug identifier.
- `oauth_scope: string`
Space-separated OAuth scopes granted on the minted token.
- `target: ServiceAccountTarget`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `type: "service_account"`
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `token_lifetime_seconds: number`
Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
- `updated_at: string`
When this rule was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
- `workspace_id: string or null`
Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.
- `workspace_ids: array of string`
Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
"applies_to_all_workspaces": true,
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"attributes": {
"foo": "string"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"issuer_id": "issuer_id",
"issuer_name": "issuer_name",
"match": {
"audience": "audience",
"claims": {
"foo": "string"
},
"condition": "condition",
"subject_prefix": "subject_prefix"
},
"name": "prod-deploy-pipeline",
"oauth_scope": "oauth_scope",
"target": {
"service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"type": "service_account",
"service_account_name": "service_account_name"
},
"token_lifetime_seconds": 0,
"type": "federation_rule",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id",
"workspace_id": "workspace_id",
"workspace_ids": [
"string"
]
}
```
api/organization/federation/rules/create New page · 302 lines, new page
# Create Federation Rule ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Create Federation Rule
url: https://platform.claude.com/docs/en/api/organization/federation/rules/create
---
# Create Federation Rule
**POST** `/v1/organizations/federation_rules`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Create a federation rule owned by your organization.
The referenced issuer and the target service account must already exist
in the same organization; invalid references are rejected with a 400
error. The workspace reference is validated. Membership is not checked
at rule creation: token exchange resolves a single enabled workspace per
call and is rejected unless the target service account is a member of
that workspace (it is implicitly a member of the default workspace).
Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite,
Terraform Cloud, Google) must constrain tenant identity via an
identity-bearing claim, a tenant-pinning subject prefix (such as
`repo:YOUR_ORG/...`), or a CEL condition referencing one of those
identity claims (e.g. `claims.repository_owner`). OAuth callers may only
manage rules whose `oauth_scope` is `workspace:developer` or
`workspace:inference`; other scopes require a Console session.
## Body parameters
- `issuer_id: string`
Tagged ID of the federation issuer.
- `match: FederationRuleMatch`
Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
maxLength: 1024
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
maxLength: 4096
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
maxLength: 1024
- `name: string`
Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
minLength: 1, maxLength: 255
- `oauth_scope: string`
Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
minLength: 1
- `target: ServiceAccountTarget`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `type: "service_account"`
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `applies_to_all_workspaces: optional boolean`
When true, enable this rule for every workspace in the org (including workspaces created later).
- `attributes: optional map[string] or null`
CEL expressions `{name: expr}` extracting named values from claims. Not yet supported; any non-empty value is rejected with 400.
- `description: optional string or null`
Optional free-text description.
maxLength: 2000
- `token_lifetime_seconds: optional number`
Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
minimum: 60, maximum: 86400
- `workspace_id: optional string or null`
Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.
## Returns
- `FederationRule object`
Authorization rule binding an external OIDC identity to Anthropic.
Evaluates the match conditions and mints an OAuth access token for the
resolved target, scoped to a single workspace where the rule is enabled
(chosen by the caller at exchange time when the rule is enabled for more
than one). For rules enabled via `workspace_ids` or
`applies_to_all_workspaces`, the target service account must be a member
of that workspace (it is implicitly a member of the default workspace);
rules carrying only the legacy `workspace_id` binding do not enforce
this.
- `type: "federation_rule"`
default: federation_rule
- `id: string`
Tagged ID of the federation rule.
- `applies_to_all_workspaces: boolean`
When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.
- `archived_at: string or null`
If set, this rule is archived and rejects token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
- `attributes: map[string] or null`
CEL expressions extracting named values from claims. Not yet supported; always null.
- `created_at: string`
When this rule was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this rule.
- `description: string or null`
Optional free-text description.
- `issuer_id: string`
Tagged ID of the issuer whose tokens this rule accepts.
- `issuer_name: string or null`
Issuer's display name at read time.
- `match: FederationRuleMatch`
Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
maxLength: 1024
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
maxLength: 4096
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
maxLength: 1024
- `name: string`
Admin-chosen slug identifier.
- `oauth_scope: string`
Space-separated OAuth scopes granted on the minted token.
- `target: ServiceAccountTarget`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `type: "service_account"`
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `token_lifetime_seconds: number`
Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
- `updated_at: string`
When this rule was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
- `workspace_id: string or null`
Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.
- `workspace_ids: array of string`
Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_rules \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"issuer_id": "issuer_id",
"match": {},
"name": "x",
"oauth_scope": "x",
"target": {
"service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"type": "service_account"
}
}'
```
### Response (200)
```json
{
"id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
"applies_to_all_workspaces": true,
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"attributes": {
"foo": "string"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"issuer_id": "issuer_id",
"issuer_name": "issuer_name",
"match": {
"audience": "audience",
"claims": {
"foo": "string"
},
"condition": "condition",
"subject_prefix": "subject_prefix"
},
"name": "prod-deploy-pipeline",
"oauth_scope": "oauth_scope",
"target": {
"service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"type": "service_account",
"service_account_name": "service_account_name"
},
"token_lifetime_seconds": 0,
"type": "federation_rule",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id",
"workspace_id": "workspace_id",
"workspace_ids": [
"string"
]
Cut at 300 lines. The page has the rest.
api/organization/federation/rules/list New page · 218 lines, new page
# List Federation Rules ## Query parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: List Federation Rules
url: https://platform.claude.com/docs/en/api/organization/federation/rules/list
---
# List Federation Rules
**GET** `/v1/organizations/federation_rules`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
List federation rules in your organization.
Optionally filter by issuer with `issuer_id`. Archived rules are excluded
unless `include_archived=true`.
## Query parameters
- `include_archived: optional boolean`
Include archived resources. Defaults to false.
default: false
- `issuer_id: optional string`
Filter to rules referencing this federation issuer.
- `limit: optional number`
Number of results per page.
default: 20, minimum: 1, maximum: 100
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
## Returns
- `data: array of FederationRule`
- `type: "federation_rule"`
default: federation_rule
- `id: string`
Tagged ID of the federation rule.
- `applies_to_all_workspaces: boolean`
When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.
- `archived_at: string or null`
If set, this rule is archived and rejects token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
- `attributes: map[string] or null`
CEL expressions extracting named values from claims. Not yet supported; always null.
- `created_at: string`
When this rule was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this rule.
- `description: string or null`
Optional free-text description.
- `issuer_id: string`
Tagged ID of the issuer whose tokens this rule accepts.
- `issuer_name: string or null`
Issuer's display name at read time.
- `match: FederationRuleMatch`
Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
maxLength: 1024
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
maxLength: 4096
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
maxLength: 1024
- `name: string`
Admin-chosen slug identifier.
- `oauth_scope: string`
Space-separated OAuth scopes granted on the minted token.
- `target: ServiceAccountTarget`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `type: "service_account"`
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `token_lifetime_seconds: number`
Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
- `updated_at: string`
When this rule was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
- `workspace_id: string or null`
Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.
- `workspace_ids: array of string`
Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
- `next_page: string or null`
Opaque cursor for the next page, or null if no more results.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_rules \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
"applies_to_all_workspaces": true,
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"attributes": {
"foo": "string"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"issuer_id": "issuer_id",
"issuer_name": "issuer_name",
"match": {
"audience": "audience",
"claims": {
"foo": "string"
},
"condition": "condition",
"subject_prefix": "subject_prefix"
},
"name": "prod-deploy-pipeline",
"oauth_scope": "oauth_scope",
"target": {
"service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"type": "service_account",
"service_account_name": "service_account_name"
},
"token_lifetime_seconds": 0,
"type": "federation_rule",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id",
"workspace_id": "workspace_id",
"workspace_ids": [
"string"
]
}
],
"next_page": "next_page"
}
```
api/organization/federation/rules/retrieve New page · 201 lines, new page
# Get Federation Rule ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Get Federation Rule
url: https://platform.claude.com/docs/en/api/organization/federation/rules/retrieve
---
# Get Federation Rule
**GET** `/v1/organizations/federation_rules/{federation_rule_id}`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Retrieve a federation rule by its ID (`fdrl_...`).
## Path parameters
- `federation_rule_id: string`
ID of the federation rule.
## Returns
- `FederationRule object`
Authorization rule binding an external OIDC identity to Anthropic.
Evaluates the match conditions and mints an OAuth access token for the
resolved target, scoped to a single workspace where the rule is enabled
(chosen by the caller at exchange time when the rule is enabled for more
than one). For rules enabled via `workspace_ids` or
`applies_to_all_workspaces`, the target service account must be a member
of that workspace (it is implicitly a member of the default workspace);
rules carrying only the legacy `workspace_id` binding do not enforce
this.
- `type: "federation_rule"`
default: federation_rule
- `id: string`
Tagged ID of the federation rule.
- `applies_to_all_workspaces: boolean`
When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.
- `archived_at: string or null`
If set, this rule is archived and rejects token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
- `attributes: map[string] or null`
CEL expressions extracting named values from claims. Not yet supported; always null.
- `created_at: string`
When this rule was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this rule.
- `description: string or null`
Optional free-text description.
- `issuer_id: string`
Tagged ID of the issuer whose tokens this rule accepts.
- `issuer_name: string or null`
Issuer's display name at read time.
- `match: FederationRuleMatch`
Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
maxLength: 1024
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
maxLength: 4096
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
maxLength: 1024
- `name: string`
Admin-chosen slug identifier.
- `oauth_scope: string`
Space-separated OAuth scopes granted on the minted token.
- `target: ServiceAccountTarget`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `type: "service_account"`
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `token_lifetime_seconds: number`
Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
- `updated_at: string`
When this rule was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
- `workspace_id: string or null`
Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.
- `workspace_ids: array of string`
Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
"applies_to_all_workspaces": true,
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"attributes": {
"foo": "string"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"issuer_id": "issuer_id",
"issuer_name": "issuer_name",
"match": {
"audience": "audience",
"claims": {
"foo": "string"
},
"condition": "condition",
"subject_prefix": "subject_prefix"
},
"name": "prod-deploy-pipeline",
"oauth_scope": "oauth_scope",
"target": {
"service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"type": "service_account",
"service_account_name": "service_account_name"
},
"token_lifetime_seconds": 0,
"type": "federation_rule",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id",
"workspace_id": "workspace_id",
"workspace_ids": [
"string"
]
}
```
api/organization/federation/rules/update New page · 297 lines, new page
# Update Federation Rule ## Path parameters ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Update Federation Rule
url: https://platform.claude.com/docs/en/api/organization/federation/rules/update
---
# Update Federation Rule
**POST** `/v1/organizations/federation_rules/{federation_rule_id}`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Partially update a federation rule.
`issuer_id` is immutable. `match` and `target` are replaced as whole
objects when set. Referenced service accounts and workspaces must exist
in your organization; invalid references are rejected with a 400 error.
Archived rules cannot be updated; this returns 400. Create a new rule
instead. Rules on well-known shared issuers (GitHub Actions, GitLab,
Buildkite, Terraform Cloud, Google) must constrain tenant identity via
an identity-bearing claim, a tenant-pinning subject prefix (such as
`repo:YOUR_ORG/...`), or a CEL condition referencing one of those
identity claims (e.g. `claims.repository_owner`). On these issuers the
requirement is re-checked on every update; if an existing rule's stored
match does not yet constrain tenant identity, any update (even a rename
or description change) must also supply a conforming `match` in the same
request. OAuth callers may only manage rules whose `oauth_scope` is
`workspace:developer` or `workspace:inference`; other scopes require a
Console session.
## Path parameters
- `federation_rule_id: string`
ID of the federation rule to update.
## Body parameters
- `applies_to_all_workspaces: optional boolean or null`
When true, enables this rule for every workspace in the org (including workspaces created later). Setting `false` is rejected with 400 if no workspace would remain enabled; a rule with only a legacy `workspace_id` binding continues to mint.
- `attributes: optional map[string] or null`
Replaces the CEL expressions `{name: expr}` extracting named values from claims. Send null to clear them. Not yet supported; any non-empty value is rejected with 400.
- `description: optional string or null`
Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).
maxLength: 2000
- `match: optional FederationRuleMatch or null`
Replaces the entire match object. All populated matcher fields must pass.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
maxLength: 1024
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
maxLength: 4096
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
maxLength: 1024
- `name: optional string or null`
Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
minLength: 1, maxLength: 255
- `oauth_scope: optional string or null`
Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
minLength: 1
- `target: optional ServiceAccountTarget or null`
Replaces the entire target object. Currently always a `service_account` target.
- `type: "service_account"`
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `token_lifetime_seconds: optional number or null`
Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
minimum: 60, maximum: 86400
- `workspace_id: optional string or null`
Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead.
## Returns
- `FederationRule object`
Authorization rule binding an external OIDC identity to Anthropic.
Evaluates the match conditions and mints an OAuth access token for the
resolved target, scoped to a single workspace where the rule is enabled
(chosen by the caller at exchange time when the rule is enabled for more
than one). For rules enabled via `workspace_ids` or
`applies_to_all_workspaces`, the target service account must be a member
of that workspace (it is implicitly a member of the default workspace);
rules carrying only the legacy `workspace_id` binding do not enforce
this.
- `type: "federation_rule"`
default: federation_rule
- `id: string`
Tagged ID of the federation rule.
- `applies_to_all_workspaces: boolean`
When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.
- `archived_at: string or null`
If set, this rule is archived and rejects token exchange.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
- `attributes: map[string] or null`
CEL expressions extracting named values from claims. Not yet supported; always null.
- `created_at: string`
When this rule was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this rule.
- `description: string or null`
Optional free-text description.
- `issuer_id: string`
Tagged ID of the issuer whose tokens this rule accepts.
- `issuer_name: string or null`
Issuer's display name at read time.
- `match: FederationRuleMatch`
Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
- `audience: optional string or null`
Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
maxLength: 1024
- `claims: optional map[string] or null`
Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
- `condition: optional string or null`
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
maxLength: 4096
- `subject_prefix: optional string or null`
Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
maxLength: 1024
- `name: string`
Admin-chosen slug identifier.
- `oauth_scope: string`
Space-separated OAuth scopes granted on the minted token.
- `target: ServiceAccountTarget`
Identity that tokens minted via this rule act as. Currently always a `service_account` target.
- `type: "service_account"`
- `service_account_id: string`
Tagged ID of the service account to mint tokens for.
- `service_account_name: optional string or null`
Service account's display name at read time. Ignored on writes.
- `token_lifetime_seconds: number`
Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
- `updated_at: string`
When this rule was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
- `workspace_id: string or null`
Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.
- `workspace_ids: array of string`
Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{}'
```
### Response (200)
```json
{
"id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
"applies_to_all_workspaces": true,
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"attributes": {
"foo": "string"
},
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"issuer_id": "issuer_id",
"issuer_name": "issuer_name",
"match": {
"audience": "audience",
"claims": {
"foo": "string"
},
"condition": "condition",
"subject_prefix": "subject_prefix"
},
"name": "prod-deploy-pipeline",
"oauth_scope": "oauth_scope",
"target": {
"service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"type": "service_account",
"service_account_name": "service_account_name"
},
"token_lifetime_seconds": 0,
"type": "federation_rule",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id",
"workspace_id": "workspace_id",
"workspace_ids": [
"string"
]
}
```
api/organization/federation/rules/workspaces New page · 256 lines, new page
# Workspaces ## Add Federation Rule Workspace ### Path parameters ### Body parameters ### Returns ### Example #### Response (200) ## List Federation Rule Workspaces ### Path parameters ### Query parameters ### Returns ### Example #### Response (200) ## Remove Federation Rule Workspace ### Path parameters ### Returns ### Example #### Response (200) ## Domain types ### Workspace Remove Response
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Workspaces
url: https://platform.claude.com/docs/en/api/organization/federation/rules/workspaces
---
# Workspaces
## Add Federation Rule Workspace
**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Enable a federation rule for a workspace.
Idempotent; re-enabling returns the existing enablement. The rule and
workspace must both belong to your organization. Membership of the
rule's target service account in this workspace is not checked at
enablement: token exchange into this workspace is rejected unless the
target is a member (it is implicitly a member of the default workspace).
Archived rules are rejected with 400. OAuth callers may only manage rules
whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
other scopes require a Console session.
### Path parameters
- `federation_rule_id: string`
ID of the federation rule.
### Body parameters
- `workspace_id: string`
Tagged ID of the workspace to enable this rule for.
### Returns
- `FederationRuleWorkspace object`
- `type: "federation_rule_workspace"`
default: federation_rule_workspace
- `created_at: string`
When this workspace was enabled for the rule.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `workspace_id: string`
Tagged ID of the workspace this rule is enabled for.
- `workspace_name: string or null`
Workspace display name. Populated when listing; null in the enable response.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"workspace_id": "workspace_id"
}'
```
#### Response (200)
```json
{
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"federation_rule_id": "federation_rule_id",
"type": "federation_rule_workspace",
"workspace_id": "workspace_id",
"workspace_name": "workspace_name"
}
```
## List Federation Rule Workspaces
**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
List workspaces where this federation rule is enabled.
Returns all workspace enablements in a single response; the `limit` and
`page` parameters are accepted but have no effect, and `next_page` is
always `null`. Returns explicit per-workspace enablements only; for
rules with `applies_to_all_workspaces` or a legacy single
`workspace_id`, check those fields on the rule itself.
### Path parameters
- `federation_rule_id: string`
ID of the federation rule.
### Query parameters
- `limit: optional number`
Number of results per page.
default: 20, minimum: 1, maximum: 100
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
### Returns
- `data: array of FederationRuleWorkspace`
- `type: "federation_rule_workspace"`
default: federation_rule_workspace
- `created_at: string`
When this workspace was enabled for the rule.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `workspace_id: string`
Tagged ID of the workspace this rule is enabled for.
- `workspace_name: string or null`
Workspace display name. Populated when listing; null in the enable response.
- `next_page: string or null`
Opaque cursor for the next page; null when there are no more results.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"data": [
{
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"federation_rule_id": "federation_rule_id",
"type": "federation_rule_workspace",
"workspace_id": "workspace_id",
"workspace_name": "workspace_name"
}
],
"next_page": "next_page"
}
```
## Remove Federation Rule Workspace
**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Disable a federation rule for a workspace.
Idempotent; succeeds even if the enablement was already removed. OAuth
callers may only manage rules whose `oauth_scope` is
`workspace:developer` or `workspace:inference`; other scopes require a
Console session.
### Path parameters
- `federation_rule_id: string`
ID of the federation rule.
- `workspace_id: string`
ID of the workspace to disable for.
### Returns
- `type: "federation_rule_workspace_deleted"`
default: federation_rule_workspace_deleted
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `workspace_id: string`
Tagged ID of the workspace named in the delete request. Removal is idempotent.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"federation_rule_id": "federation_rule_id",
"type": "federation_rule_workspace_deleted",
"workspace_id": "workspace_id"
}
```
## Domain types
### Workspace Remove Response
- `WorkspaceRemoveResponse object`
- `type: "federation_rule_workspace_deleted"`
default: federation_rule_workspace_deleted
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `workspace_id: string`
Tagged ID of the workspace named in the delete request. Removal is idempotent.
api/organization/federation/rules/workspaces/add New page · 88 lines, new page
# Add Federation Rule Workspace ## Path parameters ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Add Federation Rule Workspace
url: https://platform.claude.com/docs/en/api/organization/federation/rules/workspaces/add
---
# Add Federation Rule Workspace
**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Enable a federation rule for a workspace.
Idempotent; re-enabling returns the existing enablement. The rule and
workspace must both belong to your organization. Membership of the
rule's target service account in this workspace is not checked at
enablement: token exchange into this workspace is rejected unless the
target is a member (it is implicitly a member of the default workspace).
Archived rules are rejected with 400. OAuth callers may only manage rules
whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
other scopes require a Console session.
## Path parameters
- `federation_rule_id: string`
ID of the federation rule.
## Body parameters
- `workspace_id: string`
Tagged ID of the workspace to enable this rule for.
## Returns
- `FederationRuleWorkspace object`
- `type: "federation_rule_workspace"`
default: federation_rule_workspace
- `created_at: string`
When this workspace was enabled for the rule.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `workspace_id: string`
Tagged ID of the workspace this rule is enabled for.
- `workspace_name: string or null`
Workspace display name. Populated when listing; null in the enable response.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"workspace_id": "workspace_id"
}'
```
### Response (200)
```json
{
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"federation_rule_id": "federation_rule_id",
"type": "federation_rule_workspace",
"workspace_id": "workspace_id",
"workspace_name": "workspace_name"
}
```
api/organization/federation/rules/workspaces/list New page · 96 lines, new page
# List Federation Rule Workspaces ## Path parameters ## Query parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: List Federation Rule Workspaces
url: https://platform.claude.com/docs/en/api/organization/federation/rules/workspaces/list
---
# List Federation Rule Workspaces
**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
List workspaces where this federation rule is enabled.
Returns all workspace enablements in a single response; the `limit` and
`page` parameters are accepted but have no effect, and `next_page` is
always `null`. Returns explicit per-workspace enablements only; for
rules with `applies_to_all_workspaces` or a legacy single
`workspace_id`, check those fields on the rule itself.
## Path parameters
- `federation_rule_id: string`
ID of the federation rule.
## Query parameters
- `limit: optional number`
Number of results per page.
default: 20, minimum: 1, maximum: 100
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
## Returns
- `data: array of FederationRuleWorkspace`
- `type: "federation_rule_workspace"`
default: federation_rule_workspace
- `created_at: string`
When this workspace was enabled for the rule.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `workspace_id: string`
Tagged ID of the workspace this rule is enabled for.
- `workspace_name: string or null`
Workspace display name. Populated when listing; null in the enable response.
- `next_page: string or null`
Opaque cursor for the next page; null when there are no more results.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"federation_rule_id": "federation_rule_id",
"type": "federation_rule_workspace",
"workspace_id": "workspace_id",
"workspace_name": "workspace_name"
}
],
"next_page": "next_page"
}
```
api/organization/federation/rules/workspaces/remove New page · 60 lines, new page
# Remove Federation Rule Workspace ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Remove Federation Rule Workspace
url: https://platform.claude.com/docs/en/api/organization/federation/rules/workspaces/remove
---
# Remove Federation Rule Workspace
**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Disable a federation rule for a workspace.
Idempotent; succeeds even if the enablement was already removed. OAuth
callers may only manage rules whose `oauth_scope` is
`workspace:developer` or `workspace:inference`; other scopes require a
Console session.
## Path parameters
- `federation_rule_id: string`
ID of the federation rule.
- `workspace_id: string`
ID of the workspace to disable for.
## Returns
- `type: "federation_rule_workspace_deleted"`
default: federation_rule_workspace_deleted
- `federation_rule_id: string`
Tagged ID of the federation rule.
- `workspace_id: string`
Tagged ID of the workspace named in the delete request. Removal is idempotent.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"federation_rule_id": "federation_rule_id",
"type": "federation_rule_workspace_deleted",
"workspace_id": "workspace_id"
}
```
api/organization/invites New page · 570 lines, new page
# Invites ## Create Invite ### Body parameters ### Returns ### Example #### Response (200) ## List Invites ### Query parameters ### Returns ### Example #### Response (200) ## Get Invite ### Path parameters ### Returns ### Example #### Response (200) ## Delete Invite ### Path parameters ### Returns ### Example #### Response (200) ## Domain types ### Organization Invite ### Invite Delete Response
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Invites
url: https://platform.claude.com/docs/en/api/organization/invites
---
# Invites
## Create Invite
**POST** `/v1/organizations/invites`
Invite a user to join the organization by email.
On plans that draw members from a finite pool of purchased seats, the invite automatically consumes a seat from the lowest tier with availability; there is no seat-tier parameter. When no seat is free the request fails with a 400 error rather than purchasing a seat.
### Body parameters
- `email: string`
Email of the User.
format: email
- `role: "billing" or "claude_code_user" or "developer" or 2 more`
Role for the invited User.
The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations accept `user` and `managed`.
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"user"`
- `rbac_group_ids: optional array of string`
RBAC group IDs to assign to the User when the Invite is accepted. A non-empty array is accepted only for a Claude Enterprise organization with RBAC groups, and requires the key to carry the `write:rbac_groups` scope.
maxItems: 100
### Returns
- `OrganizationInvite object`
- `type: "invite"`
Object type.
For Invites, this is always `"invite"`.
default: invite
- `id: string`
ID of the Invite.
- `accepted_at: string or null`
RFC 3339 datetime string indicating when the Invite was accepted, or null.
format: date-time
- `email: string`
Email of the User being invited.
- `expires_at: string`
RFC 3339 datetime string indicating when the Invite expires.
format: date-time
- `invited_at: string`
RFC 3339 datetime string indicating when the Invite was created.
format: date-time
- `rbac_group_ids: array of string`
RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.
- `role: OrganizationRole`
Organization role of the User.
- `"admin"`
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"membership_admin"`
- `"owner"`
- `"primary_owner"`
- `"user"`
- `status: "accepted" or "deleted" or "expired" or "pending"`
Status of the Invite.
- `"accepted"`
- `"deleted"`
- `"expired"`
- `"pending"`
### Example
```bash
curl https://api.anthropic.com/v1/organizations/invites \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"email": "[email protected]",
"role": "user"
}'
```
#### Response (200)
```json
{
"id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
"accepted_at": "2019-12-27T18:11:19.117Z",
"email": "[email protected]",
"expires_at": "2024-11-20T23:58:27.427722Z",
"invited_at": "2024-10-30T23:58:27.427722Z",
"rbac_group_ids": [
"string"
],
"role": "admin",
"status": "pending",
"type": "invite"
}
```
## List Invites
**GET** `/v1/organizations/invites`
List the organization's invites.
### Query parameters
- `after_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.
- `before_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.
- `email: optional string`
Filter by the email address the Invite was sent to. Matches the same way as the Users list's `email` filter (normalized, case-insensitive).
format: email
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, minimum: 1, maximum: 1000
- `roles: optional array of string`
Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together.
Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`.
- `statuses: optional array of "accepted" or "expired" or "pending"`
Filter by Invite status. Repeatable; values are OR'ed together. Omit to return `pending`, `accepted`, and `expired` Invites alike.
- `"accepted"`
- `"expired"`
- `"pending"`
### Returns
- `data: array of OrganizationInvite`
- `type: "invite"`
Object type.
For Invites, this is always `"invite"`.
default: invite
- `id: string`
ID of the Invite.
- `accepted_at: string or null`
RFC 3339 datetime string indicating when the Invite was accepted, or null.
format: date-time
- `email: string`
Email of the User being invited.
- `expires_at: string`
RFC 3339 datetime string indicating when the Invite expires.
format: date-time
- `invited_at: string`
RFC 3339 datetime string indicating when the Invite was created.
format: date-time
- `rbac_group_ids: array of string`
RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.
- `role: OrganizationRole`
Organization role of the User.
- `"admin"`
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"membership_admin"`
- `"owner"`
- `"primary_owner"`
- `"user"`
- `status: "accepted" or "deleted" or "expired" or "pending"`
Status of the Invite.
- `"accepted"`
- `"deleted"`
- `"expired"`
- `"pending"`
- `first_id: string or null`
First ID in the `data` list. Can be used as the `before_id` for the previous page.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `last_id: string or null`
Last ID in the `data` list. Can be used as the `after_id` for the next page.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/invites \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"data": [
{
Cut at 300 lines. The page has the rest.
api/organization/invites/create New page · 149 lines, new page
# Create Invite ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Create Invite
url: https://platform.claude.com/docs/en/api/organization/invites/create
---
# Create Invite
**POST** `/v1/organizations/invites`
Invite a user to join the organization by email.
On plans that draw members from a finite pool of purchased seats, the invite automatically consumes a seat from the lowest tier with availability; there is no seat-tier parameter. When no seat is free the request fails with a 400 error rather than purchasing a seat.
## Body parameters
- `email: string`
Email of the User.
format: email
- `role: "billing" or "claude_code_user" or "developer" or 2 more`
Role for the invited User.
The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations accept `user` and `managed`.
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"user"`
- `rbac_group_ids: optional array of string`
RBAC group IDs to assign to the User when the Invite is accepted. A non-empty array is accepted only for a Claude Enterprise organization with RBAC groups, and requires the key to carry the `write:rbac_groups` scope.
maxItems: 100
## Returns
- `OrganizationInvite object`
- `type: "invite"`
Object type.
For Invites, this is always `"invite"`.
default: invite
- `id: string`
ID of the Invite.
- `accepted_at: string or null`
RFC 3339 datetime string indicating when the Invite was accepted, or null.
format: date-time
- `email: string`
Email of the User being invited.
- `expires_at: string`
RFC 3339 datetime string indicating when the Invite expires.
format: date-time
- `invited_at: string`
RFC 3339 datetime string indicating when the Invite was created.
format: date-time
- `rbac_group_ids: array of string`
RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.
- `role: OrganizationRole`
Organization role of the User.
- `"admin"`
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"membership_admin"`
- `"owner"`
- `"primary_owner"`
- `"user"`
- `status: "accepted" or "deleted" or "expired" or "pending"`
Status of the Invite.
- `"accepted"`
- `"deleted"`
- `"expired"`
- `"pending"`
## Example
```bash
curl https://api.anthropic.com/v1/organizations/invites \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"email": "[email protected]",
"role": "user"
}'
```
### Response (200)
```json
{
"id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
"accepted_at": "2019-12-27T18:11:19.117Z",
"email": "[email protected]",
"expires_at": "2024-11-20T23:58:27.427722Z",
"invited_at": "2024-10-30T23:58:27.427722Z",
"rbac_group_ids": [
"string"
],
"role": "admin",
"status": "pending",
"type": "invite"
}
```
api/organization/invites/delete New page · 48 lines, new page
# Delete Invite ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Delete Invite
url: https://platform.claude.com/docs/en/api/organization/invites/delete
---
# Delete Invite
**DELETE** `/v1/organizations/invites/{invite_id}`
Delete a pending invite.
## Path parameters
- `invite_id: string`
ID of the Invite.
## Returns
- `type: "invite_deleted"`
Deleted object type.
For Invites, this is always `"invite_deleted"`.
default: invite_deleted
- `id: string`
ID of the Invite.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \
-X DELETE \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
"type": "invite_deleted"
}
```
api/organization/invites/list New page · 171 lines, new page
# List Invites ## Query parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: List Invites
url: https://platform.claude.com/docs/en/api/organization/invites/list
---
# List Invites
**GET** `/v1/organizations/invites`
List the organization's invites.
## Query parameters
- `after_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.
- `before_id: optional string`
ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.
- `email: optional string`
Filter by the email address the Invite was sent to. Matches the same way as the Users list's `email` filter (normalized, case-insensitive).
format: email
- `limit: optional number`
Number of items to return per page.
Defaults to `20`. Ranges from `1` to `1000`.
default: 20, minimum: 1, maximum: 1000
- `roles: optional array of string`
Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together.
Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`.
- `statuses: optional array of "accepted" or "expired" or "pending"`
Filter by Invite status. Repeatable; values are OR'ed together. Omit to return `pending`, `accepted`, and `expired` Invites alike.
- `"accepted"`
- `"expired"`
- `"pending"`
## Returns
- `data: array of OrganizationInvite`
- `type: "invite"`
Object type.
For Invites, this is always `"invite"`.
default: invite
- `id: string`
ID of the Invite.
- `accepted_at: string or null`
RFC 3339 datetime string indicating when the Invite was accepted, or null.
format: date-time
- `email: string`
Email of the User being invited.
- `expires_at: string`
RFC 3339 datetime string indicating when the Invite expires.
format: date-time
- `invited_at: string`
RFC 3339 datetime string indicating when the Invite was created.
format: date-time
- `rbac_group_ids: array of string`
RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.
- `role: OrganizationRole`
Organization role of the User.
- `"admin"`
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"membership_admin"`
- `"owner"`
- `"primary_owner"`
- `"user"`
- `status: "accepted" or "deleted" or "expired" or "pending"`
Status of the Invite.
- `"accepted"`
- `"deleted"`
- `"expired"`
- `"pending"`
- `first_id: string or null`
First ID in the `data` list. Can be used as the `before_id` for the previous page.
- `has_more: boolean`
Indicates if there are more results in the requested page direction.
- `last_id: string or null`
Last ID in the `data` list. Can be used as the `after_id` for the next page.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/invites \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
"accepted_at": "2019-12-27T18:11:19.117Z",
"email": "[email protected]",
"expires_at": "2024-11-20T23:58:27.427722Z",
"invited_at": "2024-10-30T23:58:27.427722Z",
"rbac_group_ids": [
"string"
],
"role": "admin",
"status": "pending",
"type": "invite"
}
],
"first_id": "first_id",
"has_more": true,
"last_id": "last_id"
}
```
api/organization/invites/retrieve New page · 118 lines, new page
# Get Invite ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Get Invite
url: https://platform.claude.com/docs/en/api/organization/invites/retrieve
---
# Get Invite
**GET** `/v1/organizations/invites/{invite_id}`
Retrieve an invite by ID.
## Path parameters
- `invite_id: string`
ID of the Invite.
## Returns
- `OrganizationInvite object`
- `type: "invite"`
Object type.
For Invites, this is always `"invite"`.
default: invite
- `id: string`
ID of the Invite.
- `accepted_at: string or null`
RFC 3339 datetime string indicating when the Invite was accepted, or null.
format: date-time
- `email: string`
Email of the User being invited.
- `expires_at: string`
RFC 3339 datetime string indicating when the Invite expires.
format: date-time
- `invited_at: string`
RFC 3339 datetime string indicating when the Invite was created.
format: date-time
- `rbac_group_ids: array of string`
RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.
- `role: OrganizationRole`
Organization role of the User.
- `"admin"`
- `"billing"`
- `"claude_code_user"`
- `"developer"`
- `"managed"`
- `"membership_admin"`
- `"owner"`
- `"primary_owner"`
- `"user"`
- `status: "accepted" or "deleted" or "expired" or "pending"`
Status of the Invite.
- `"accepted"`
- `"deleted"`
- `"expired"`
- `"pending"`
## Example
```bash
curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
"accepted_at": "2019-12-27T18:11:19.117Z",
"email": "[email protected]",
"expires_at": "2024-11-20T23:58:27.427722Z",
"invited_at": "2024-10-30T23:58:27.427722Z",
"rbac_group_ids": [
"string"
],
"role": "admin",
"status": "pending",
"type": "invite"
}
```
api/organization/rate_limits New page · 455 lines, new page
# Rate Limits ## List Organization Rate Limits ### Query parameters ### Returns ### Example #### Response (200) ## Domain types ### Organization Rate Limit ### Organization Rate Limit Batch Group ### Organization Rate Limit Files Group ### Organization Rate Limit Model Group ### Organization Rate Limit Skills Group ### Organization Rate Limit Token Count Group ### Organization Rate Limit Value ### Organization Rate Limit Web Search Group
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Rate Limits
url: https://platform.claude.com/docs/en/api/organization/rate_limits
---
# Rate Limits
## List Organization Rate Limits
**GET** `/v1/organizations/rate_limits`
List Messages API rate limits for your organization.
Each entry corresponds to one rate-limit group (either a model family
or an API-surface category such as the Files API or Message Batches)
and contains the set of limiter values that apply to it.
When `limit` is omitted, every matching entry is returned in a single
page; when `limit` truncates the result, follow `next_page` to fetch
the remaining entries.
### Query parameters
- `group_type: optional "batch" or "files" or "model_group" or 3 more`
Filter by group type.
- `"batch"`
- `"files"`
- `"model_group"`
- `"skills"`
- `"token_count"`
- `"web_search"`
- `limit: optional number`
Maximum number of items to return per page. Ranges from `1` to `1000`.
When omitted, every remaining entry is returned in a single page and `next_page` is `null`.
minimum: 1, maximum: 1000
- `model: optional string`
Filter to the single entry containing this model. Accepts full model names and aliases. Returns 404 if the model is not found or has no rate limits for this organization.
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
### Returns
- `data: array of OrganizationRateLimit`
Rate-limit entries for the organization, one per group.
- `type: "rate_limit"`
Object type. Always `rate_limit` for organization rate-limit entries.
default: rate_limit
- `id: string`
Identifier of this rate-limit entry. It is stable within the organization and differs between organizations; the group's own identifier is `group.id`.
- `group: OrganizationRateLimitModelGroup or OrganizationRateLimitBatchGroup or OrganizationRateLimitTokenCountGroup or 3 more`
The rate-limit group this entry's limits apply to. Its `type` equals `group_type`.
- `OrganizationRateLimitModelGroup object`
- `type: "model_group"`
Always `model_group`: a family of models.
default: model_group
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `display_name: string`
Human-readable name of the model group (for example, `Claude Sonnet 4.x`). For display only; it may change.
- `OrganizationRateLimitBatchGroup object`
- `type: "batch"`
Always `batch`: the Message Batches API.
default: batch
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `OrganizationRateLimitTokenCountGroup object`
- `type: "token_count"`
Always `token_count`: the Token Count API.
default: token_count
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `OrganizationRateLimitFilesGroup object`
- `type: "files"`
Always `files`: the Files API.
default: files
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `OrganizationRateLimitSkillsGroup object`
- `type: "skills"`
Always `skills`: the Skills API.
default: skills
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `OrganizationRateLimitWebSearchGroup object`
- `type: "web_search"`
Always `web_search`: the Messages API web search tool.
default: web_search
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `limits: array of OrganizationRateLimitValue`
The limiter values that apply to this group.
- `type: string`
The limiter type (for example, `requests_per_minute` or `input_tokens_per_minute`).
- `value: number`
The configured limit value for this limiter type.
- `models: array of string or null`
Model names this entry's limits apply to, including aliases. `null` when `group_type` is not `"model_group"`.
- `group_type: "batch" or "files" or "model_group" or 3 more`
**Deprecated**: Use `group.type` instead. `group_type` is still returned and always equals `group.type`.
Deprecated: use `group.type` instead. The kind of rate-limit group this entry represents. `model_group` entries apply to a family of models (listed in `models`); other values apply to an API-surface category and have `models` set to `null`. Always equal to `group.type`.
- `"batch"`
- `"files"`
- `"model_group"`
- `"skills"`
- `"token_count"`
- `"web_search"`
- `next_page: string or null`
Opaque cursor for the next page of results, or `null` when no entries remain beyond this response.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/rate_limits \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"data": [
{
"id": "id",
"group": {
"id": "id",
"display_name": "display_name",
"type": "model_group"
},
"group_type": "batch",
"limits": [
{
"type": "type",
"value": 0
}
],
"models": [
"string"
],
"type": "rate_limit"
}
],
"next_page": "next_page"
}
```
## Domain types
### Organization Rate Limit
- `OrganizationRateLimit object`
- `type: "rate_limit"`
Object type. Always `rate_limit` for organization rate-limit entries.
default: rate_limit
- `id: string`
Identifier of this rate-limit entry. It is stable within the organization and differs between organizations; the group's own identifier is `group.id`.
- `group: OrganizationRateLimitModelGroup or OrganizationRateLimitBatchGroup or OrganizationRateLimitTokenCountGroup or 3 more`
The rate-limit group this entry's limits apply to. Its `type` equals `group_type`.
- `OrganizationRateLimitModelGroup object`
- `type: "model_group"`
Always `model_group`: a family of models.
default: model_group
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `display_name: string`
Human-readable name of the model group (for example, `Claude Sonnet 4.x`). For display only; it may change.
- `OrganizationRateLimitBatchGroup object`
- `type: "batch"`
Always `batch`: the Message Batches API.
default: batch
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `OrganizationRateLimitTokenCountGroup object`
- `type: "token_count"`
Always `token_count`: the Token Count API.
default: token_count
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `OrganizationRateLimitFilesGroup object`
- `type: "files"`
Always `files`: the Files API.
default: files
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `OrganizationRateLimitSkillsGroup object`
Cut at 300 lines. The page has the rest.
api/organization/rate_limits/list New page · 223 lines, new page
# List Organization Rate Limits ## Query parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: List Organization Rate Limits
url: https://platform.claude.com/docs/en/api/organization/rate_limits/list
---
# List Organization Rate Limits
**GET** `/v1/organizations/rate_limits`
List Messages API rate limits for your organization.
Each entry corresponds to one rate-limit group (either a model family
or an API-surface category such as the Files API or Message Batches)
and contains the set of limiter values that apply to it.
When `limit` is omitted, every matching entry is returned in a single
page; when `limit` truncates the result, follow `next_page` to fetch
the remaining entries.
## Query parameters
- `group_type: optional "batch" or "files" or "model_group" or 3 more`
Filter by group type.
- `"batch"`
- `"files"`
- `"model_group"`
- `"skills"`
- `"token_count"`
- `"web_search"`
- `limit: optional number`
Maximum number of items to return per page. Ranges from `1` to `1000`.
When omitted, every remaining entry is returned in a single page and `next_page` is `null`.
minimum: 1, maximum: 1000
- `model: optional string`
Filter to the single entry containing this model. Accepts full model names and aliases. Returns 404 if the model is not found or has no rate limits for this organization.
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
## Returns
- `data: array of OrganizationRateLimit`
Rate-limit entries for the organization, one per group.
- `type: "rate_limit"`
Object type. Always `rate_limit` for organization rate-limit entries.
default: rate_limit
- `id: string`
Identifier of this rate-limit entry. It is stable within the organization and differs between organizations; the group's own identifier is `group.id`.
- `group: OrganizationRateLimitModelGroup or OrganizationRateLimitBatchGroup or OrganizationRateLimitTokenCountGroup or 3 more`
The rate-limit group this entry's limits apply to. Its `type` equals `group_type`.
- `OrganizationRateLimitModelGroup object`
- `type: "model_group"`
Always `model_group`: a family of models.
default: model_group
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `display_name: string`
Human-readable name of the model group (for example, `Claude Sonnet 4.x`). For display only; it may change.
- `OrganizationRateLimitBatchGroup object`
- `type: "batch"`
Always `batch`: the Message Batches API.
default: batch
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `OrganizationRateLimitTokenCountGroup object`
- `type: "token_count"`
Always `token_count`: the Token Count API.
default: token_count
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `OrganizationRateLimitFilesGroup object`
- `type: "files"`
Always `files`: the Files API.
default: files
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `OrganizationRateLimitSkillsGroup object`
- `type: "skills"`
Always `skills`: the Skills API.
default: skills
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `OrganizationRateLimitWebSearchGroup object`
- `type: "web_search"`
Always `web_search`: the Messages API web search tool.
default: web_search
- `id: string`
Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization.
- `limits: array of OrganizationRateLimitValue`
The limiter values that apply to this group.
- `type: string`
The limiter type (for example, `requests_per_minute` or `input_tokens_per_minute`).
- `value: number`
The configured limit value for this limiter type.
- `models: array of string or null`
Model names this entry's limits apply to, including aliases. `null` when `group_type` is not `"model_group"`.
- `group_type: "batch" or "files" or "model_group" or 3 more`
**Deprecated**: Use `group.type` instead. `group_type` is still returned and always equals `group.type`.
Deprecated: use `group.type` instead. The kind of rate-limit group this entry represents. `model_group` entries apply to a family of models (listed in `models`); other values apply to an API-surface category and have `models` set to `null`. Always equal to `group.type`.
- `"batch"`
- `"files"`
- `"model_group"`
- `"skills"`
- `"token_count"`
- `"web_search"`
- `next_page: string or null`
Opaque cursor for the next page of results, or `null` when no entries remain beyond this response.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/rate_limits \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"id": "id",
"group": {
"id": "id",
"display_name": "display_name",
"type": "model_group"
},
"group_type": "batch",
"limits": [
{
"type": "type",
"value": 0
}
],
"models": [
"string"
],
"type": "rate_limit"
}
],
"next_page": "next_page"
}
```
api/organization/retrieve New page · 50 lines, new page
# Get Current Organization ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Get Current Organization
url: https://platform.claude.com/docs/en/api/organization/retrieve
---
# Get Current Organization
**GET** `/v1/organizations/me`
Retrieve information about the organization associated with the authenticated API key.
## Returns
- `OrganizationInfo object`
- `type: "organization"`
Object type.
For Organizations, this is always `"organization"`.
default: organization
- `id: string`
ID of the Organization.
format: uuid
- `name: string`
Name of the Organization.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/me \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "12345678-1234-5678-1234-567812345678",
"name": "Organization Name",
"type": "organization"
}
```
api/organization/service_accounts New page · 973 lines, new page
# Service Accounts ## Create Service Account ### Body parameters ### Returns ### Example #### Response (200) ## List Service Accounts ### Query parameters ### Returns ### Example #### Response (200) ## Get Service Account ### Path parameters ### Returns ### Example #### Response (200) ## Update Service Account ### Path parameters ### Body parameters ### Returns ### Example #### Response (200) ## Archive Service Account ### Path parameters ### Returns ### Example #### Response (200) ## Domain types ### Service Account ### Service Account Workspace Member ## Service Accounts › Workspaces ### Add Workspace To Service Account #### Path parameters #### Body parameters #### Returns #### Example ##### Response (200) ### List Workspaces For Service Account #### Path parameters #### Query parameters #### Returns #### Example ##### Response (200) ### Remove Workspace From Service Account #### Path parameters #### Returns #### Example ##### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Service Accounts
url: https://platform.claude.com/docs/en/api/organization/service_accounts
---
# Service Accounts
## Create Service Account
**POST** `/v1/organizations/service_accounts`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Create a service account.
A service account is a named workload identity that federation rules
target. `organization_role` is `developer` (default) or `admin`; a rule
may only be created or retargeted to grant `org:admin` scope when the
target's `organization_role` is `admin`. Creating an `admin`-role service
account requires an interactive credential (a user OAuth token or a
Console session) — a workload may only create `developer`-role service
accounts.
### Body parameters
- `name: string`
Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
minLength: 1, maxLength: 255
- `description: optional string or null`
Optional free-text description.
maxLength: 2000
- `organization_role: optional "admin" or "developer"`
Org-level role. Defaults to `developer`.
- `"admin"`
- `"developer"`
### Returns
- `ServiceAccount object`
Named non-human identity within the caller's organization.
A service account is a pure identity: name + org. Authorization lives on
whatever references it (federation rules).
- `type: "service_account"`
default: service_account
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
- `created_at: string`
When this service account was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this service account.
- `description: string or null`
Optional free-text description.
- `name: string`
Admin-chosen slug identifier.
- `organization_role: "admin" or "developer"`
Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.
- `"admin"`
- `"developer"`
- `updated_at: string`
When this service account was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/service_accounts \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"name": "ci-deploy-bot"
}'
```
#### Response (200)
```json
{
"id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"name": "ci-deploy-bot",
"organization_role": "admin",
"type": "service_account",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
## List Service Accounts
**GET** `/v1/organizations/service_accounts`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
List service accounts in the caller's organization.
Results are ordered by creation time, newest first. Use `limit` and the
`next_page` cursor to paginate; set `include_archived=true` to include
archived service accounts.
### Query parameters
- `include_archived: optional boolean`
Include archived resources. Defaults to false.
default: false
- `limit: optional number`
Number of results per page.
default: 20, minimum: 1, maximum: 100
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
### Returns
- `data: array of ServiceAccount`
- `type: "service_account"`
default: service_account
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
- `created_at: string`
When this service account was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this service account.
- `description: string or null`
Optional free-text description.
- `name: string`
Admin-chosen slug identifier.
- `organization_role: "admin" or "developer"`
Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.
- `"admin"`
- `"developer"`
- `updated_at: string`
When this service account was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
- `next_page: string or null`
Opaque cursor for the next page, or null if no more results.
### Example
```bash
curl https://api.anthropic.com/v1/organizations/service_accounts \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
#### Response (200)
```json
{
"data": [
{
"id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"name": "ci-deploy-bot",
"organization_role": "admin",
"type": "service_account",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
],
"next_page": "next_page"
}
```
## Get Service Account
**GET** `/v1/organizations/service_accounts/{service_account_id}`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Retrieve a service account by its ID (`svac_...`).
### Path parameters
- `service_account_id: string`
ID of the service account.
### Returns
- `ServiceAccount object`
Named non-human identity within the caller's organization.
A service account is a pure identity: name + org. Authorization lives on
whatever references it (federation rules).
- `type: "service_account"`
default: service_account
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
format: date-time
- `archived_by_actor_id: string or null`
Cut at 300 lines. The page has the rest.
api/organization/service_accounts/archive New page · 113 lines, new page
# Archive Service Account ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Archive Service Account
url: https://platform.claude.com/docs/en/api/organization/service_accounts/archive
---
# Archive Service Account
**POST** `/v1/organizations/service_accounts/{service_account_id}/archive`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Archive a service account.
Idempotent; re-archiving returns the service account with its original
`archived_at`. Rejected with 400 if any live (non-archived) federation
rule still targets this service account, same as issuer archival; archive
those rules first or change their target to another service account.
## Path parameters
- `service_account_id: string`
ID of the service account to archive.
## Returns
- `ServiceAccount object`
Named non-human identity within the caller's organization.
A service account is a pure identity: name + org. Authorization lives on
whatever references it (federation rules).
- `type: "service_account"`
default: service_account
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
- `created_at: string`
When this service account was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this service account.
- `description: string or null`
Optional free-text description.
- `name: string`
Admin-chosen slug identifier.
- `organization_role: "admin" or "developer"`
Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.
- `"admin"`
- `"developer"`
- `updated_at: string`
When this service account was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/archive \
-X POST \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"name": "ci-deploy-bot",
"organization_role": "admin",
"type": "service_account",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
api/organization/service_accounts/create New page · 135 lines, new page
# Create Service Account ## Body parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Create Service Account
url: https://platform.claude.com/docs/en/api/organization/service_accounts/create
---
# Create Service Account
**POST** `/v1/organizations/service_accounts`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Create a service account.
A service account is a named workload identity that federation rules
target. `organization_role` is `developer` (default) or `admin`; a rule
may only be created or retargeted to grant `org:admin` scope when the
target's `organization_role` is `admin`. Creating an `admin`-role service
account requires an interactive credential (a user OAuth token or a
Console session) — a workload may only create `developer`-role service
accounts.
## Body parameters
- `name: string`
Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
minLength: 1, maxLength: 255
- `description: optional string or null`
Optional free-text description.
maxLength: 2000
- `organization_role: optional "admin" or "developer"`
Org-level role. Defaults to `developer`.
- `"admin"`
- `"developer"`
## Returns
- `ServiceAccount object`
Named non-human identity within the caller's organization.
A service account is a pure identity: name + org. Authorization lives on
whatever references it (federation rules).
- `type: "service_account"`
default: service_account
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
- `created_at: string`
When this service account was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this service account.
- `description: string or null`
Optional free-text description.
- `name: string`
Admin-chosen slug identifier.
- `organization_role: "admin" or "developer"`
Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.
- `"admin"`
- `"developer"`
- `updated_at: string`
When this service account was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/service_accounts \
-H 'Content-Type: application/json' \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY" \
-d '{
"name": "ci-deploy-bot"
}'
```
### Response (200)
```json
{
"id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"name": "ci-deploy-bot",
"organization_role": "admin",
"type": "service_account",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```
api/organization/service_accounts/list New page · 127 lines, new page
# List Service Accounts ## Query parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: List Service Accounts
url: https://platform.claude.com/docs/en/api/organization/service_accounts/list
---
# List Service Accounts
**GET** `/v1/organizations/service_accounts`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
List service accounts in the caller's organization.
Results are ordered by creation time, newest first. Use `limit` and the
`next_page` cursor to paginate; set `include_archived=true` to include
archived service accounts.
## Query parameters
- `include_archived: optional boolean`
Include archived resources. Defaults to false.
default: false
- `limit: optional number`
Number of results per page.
default: 20, minimum: 1, maximum: 100
- `page: optional string`
Opaque cursor from a previous response's `next_page`.
## Returns
- `data: array of ServiceAccount`
- `type: "service_account"`
default: service_account
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
- `created_at: string`
When this service account was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this service account.
- `description: string or null`
Optional free-text description.
- `name: string`
Admin-chosen slug identifier.
- `organization_role: "admin" or "developer"`
Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.
- `"admin"`
- `"developer"`
- `updated_at: string`
When this service account was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
- `next_page: string or null`
Opaque cursor for the next page, or null if no more results.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/service_accounts \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"data": [
{
"id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"name": "ci-deploy-bot",
"organization_role": "admin",
"type": "service_account",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
],
"next_page": "next_page"
}
```
api/organization/service_accounts/retrieve New page · 107 lines, new page
# Get Service Account ## Path parameters ## Returns ## Example ### Response (200)
A whole new page. There's nothing to diff it against, so here is what it says.
---
title: Get Service Account
url: https://platform.claude.com/docs/en/api/organization/service_accounts/retrieve
---
# Get Service Account
**GET** `/v1/organizations/service_accounts/{service_account_id}`
**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
Retrieve a service account by its ID (`svac_...`).
## Path parameters
- `service_account_id: string`
ID of the service account.
## Returns
- `ServiceAccount object`
Named non-human identity within the caller's organization.
A service account is a pure identity: name + org. Authorization lives on
whatever references it (federation rules).
- `type: "service_account"`
default: service_account
- `id: string`
Tagged ID of the service account.
- `archived_at: string or null`
If set, this service account is archived.
format: date-time
- `archived_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that archived this service account.
- `created_at: string`
When this service account was created.
format: date-time
- `created_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that created this service account.
- `description: string or null`
Optional free-text description.
- `name: string`
Admin-chosen slug identifier.
- `organization_role: "admin" or "developer"`
Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.
- `"admin"`
- `"developer"`
- `updated_at: string`
When this service account was last updated.
format: date-time
- `updated_by_actor_id: string or null`
Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.
## Example
```bash
curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID \
-H 'anthropic-version: 2023-06-01' \
-H "X-Api-Key: $ANTHROPIC_API_KEY"
```
### Response (200)
```json
{
"id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
"archived_at": "2019-12-27T18:11:19.117Z",
"archived_by_actor_id": "archived_by_actor_id",
"created_at": "2024-10-30T23:58:27.427722Z",
"created_by_actor_id": "created_by_actor_id",
"description": "description",
"name": "ci-deploy-bot",
"organization_role": "admin",
"type": "service_account",
"updated_at": "2024-10-30T23:58:27.427722Z",
"updated_by_actor_id": "updated_by_actor_id"
}
```