api-20261019T193710Z / page 2 of 4 / documentation capture

build-with-claude/skills-guide Changed · +47 / -272 lines

from line 316

316316

317317**Example: creating and downloading an Excel file**

318318

319<CodeGroup>

320 ```bash cURL

321 # Step 1: Use a Skill to create a file

322 RESPONSE=$(curl https://api.anthropic.com/v1/messages \

323 -H "x-api-key: $ANTHROPIC_API_KEY" \

324 -H "anthropic-version: 2023-06-01" \

325 -H "content-type: application/json" \

326 -d '{

327 "model": "claude-opus-5-5",

328 "max_tokens": 4096,

329 "container": {

330 "skills": [

331 {"type": "anthropic", "skill_id": "xlsx", "version": "latest"}

332 ]

333 },

334 "messages": [{

335 "role": "user",

336 "content": "Create an Excel file with a simple budget spreadsheet"

337 }],

338 "tools": [{

339 "type": "code_execution_20250825",

340 "name": "code_execution"

341 }]

342 }')

319<CodeGroup exclude="shell:cURL, shell:CLI">

320 <CodeGroupItem language="cURL">

321 This workflow needs more logic than a single shell command. Use the [Claude SDK](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) to run it.

322 </CodeGroupItem>

343323

344 # Step 2: Extract file_id from response (using jq)

324 <CodeGroupItem language="CLI">

325 This workflow needs more logic than a single shell command. Use the [Claude SDK](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) to run it.

326 </CodeGroupItem>

346327

347 # Step 3: Get filename from metadata

348 FILENAME=$(curl "https://api.anthropic.com/v1/files/$FILE_ID" \

349 -H "x-api-key: $ANTHROPIC_API_KEY" \

350 -H "anthropic-version: 2023-06-01" | jq -r '.filename')

351

352 # Step 4: Download the file using Files API

353 curl "https://api.anthropic.com/v1/files/$FILE_ID/content" \

354 -H "x-api-key: $ANTHROPIC_API_KEY" \

355 -H "anthropic-version: 2023-06-01" \

356 --output "$FILENAME"

357

358 echo "Downloaded: $FILENAME"

359 ```

360

361 ```bash CLI

362 # Step 1: Use the xlsx Skill to create a file

363 # Step 2: Extract file_id from the response with --transform (GJSON path)

364 FILE_ID=$(ant messages create \

365 --transform 'content.#.content.content.#.file_id|@flatten|0' \

366 --raw-output <<'YAML'

367 model: claude-opus-5-5

368 max_tokens: 4096

369 container:

370 skills:

371 - type: anthropic

372 skill_id: xlsx

373 version: latest

374 messages:

375 - role: user

376 content: Create an Excel file with a simple budget spreadsheet

377 tools:

378 - type: code_execution_20250825

379 name: code_execution

380 YAML

381 )

382

383 # Step 3: Get the filename from file metadata

384 FILENAME=$(ant files retrieve-metadata \

385 --file-id "$FILE_ID" \

386 --transform filename \

387 --raw-output)

388

389 # Step 4: Download the file using Files API

390 ant files download --file-id "$FILE_ID" --output "$FILENAME" > /dev/null

391

392 printf 'Downloaded: %s\n' "$FILENAME"

393 ```

394

395328 ```python Python

396329 client = anthropic.Anthropic()

397330

from line 713

780713 ```bash CLI

781714 # Get file metadata

782715 ant files retrieve-metadata \

783 --file-id "$FILE_ID" \

784 --transform '{filename,size_bytes}' \

785 --format yaml

716 --file-id "$FILE_ID"

786717

787718 # List all files

788 ant files list --transform '{filename,created_at}' --format yaml

719 ant files list

789720

790721 # Delete a file

791 ant files delete --file-id "$FILE_ID" >/dev/null

722 ant files delete --file-id "$FILE_ID"

792723 ```

793724

794725 ```python Python

from line 867

936867

937868The response's `container` object carries the container's `id` and `expires_at` timestamp (see [Container reuse](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool#container-reuse) for lifetime details). Reuse the same container across multiple messages by specifying the container ID:

938869

939<CodeGroup exclude="shell:cURL">

870<CodeGroup exclude="shell:cURL, shell:CLI">

940871 <CodeGroupItem language="cURL">

941872 Multi-turn container reuse needs more logic than a single shell command, so use the Claude SDK for it. To build the requests yourself, capture `container.id` from the first response. Then pass it in the next request as `"container": {"id": "...", "skills": [...]}`, together with the conversation history.

942873 </CodeGroupItem>

943874

944 ```bash CLI

945 # First request creates container

946 CONTAINER_ID=$(ant messages create \

947 --transform container.id \

948 --raw-output <<'YAML'

949 model: claude-opus-5-5

950 max_tokens: 4096

951 container:

952 skills:

953 - {type: anthropic, skill_id: xlsx, version: latest}

954 messages:

955 - role: user

956 content: Create a sample sales dataset and analyze it

957 tools:

958 - {type: code_execution_20250825, name: code_execution}

959 YAML

960 )

875 <CodeGroupItem language="CLI">

876 This workflow needs more logic than a single shell command. Use the [Claude SDK](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) to run it.

877 </CodeGroupItem>

961878

962 # Continue conversation with same container

963 ant messages create <<YAML

964 model: claude-opus-5-5

965 max_tokens: 4096

966 container:

967 id: $CONTAINER_ID # Reuse container

968 skills:

969 - {type: anthropic, skill_id: xlsx, version: latest}

970 messages:

971 - role: user

972 content: Create a sample sales dataset and analyze it

973 - role: assistant

974 content: [] # the assistant's text from the first response

975 - role: user

976 content: What was the total revenue?

977 tools:

978 - {type: code_execution_20250825, name: code_execution}

979 YAML

980 ```

981

982879 ```python Python

983880 client = anthropic.Anthropic()

984881

from line 1239

13421239

13431240Skills may perform operations that require multiple turns. Handle `pause_turn` stop reasons:

13441241

1345<CodeGroup>

1346 ```bash cURL

1347 # Initial request

1348 RESPONSE=$(curl https://api.anthropic.com/v1/messages \

1349 -H "x-api-key: $ANTHROPIC_API_KEY" \

1350 -H "anthropic-version: 2023-06-01" \

1351 -H "content-type: application/json" \

1352 -d '{

1353 "model": "claude-opus-5-5",

1354 "max_tokens": 4096,

1355 "container": {

1356 "skills": [

1357 {

1358 "type": "custom",

1359 "skill_id": "skill_01AbCdEfGhIjKlMnOpQrStUv",

1360 "version": "latest"

1361 }

1362 ]

1363 },

1364 "messages": [{

1365 "role": "user",

1366 "content": "Generate and process a large sample dataset"

1367 }],

1368 "tools": [{

1369 "type": "code_execution_20250825",

1370 "name": "code_execution"

1371 }]

1372 }')

1242<CodeGroup exclude="shell:cURL, shell:CLI">

1243 <CodeGroupItem language="cURL">

1244 This workflow needs more logic than a single shell command. Use the [Claude SDK](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) to run it.

1245 </CodeGroupItem>

13731246

1374 # If stop_reason is "pause_turn", continue in the same container, appending

1375 # the prior response's content array to messages as the assistant turn.

1376 # Repeat this continuation request until stop_reason is no longer "pause_turn".

1377 STOP_REASON=$(echo "$RESPONSE" | jq -r '.stop_reason')

1378 CONTAINER_ID=$(echo "$RESPONSE" | jq -r '.container.id')

1247 <CodeGroupItem language="CLI">

1248 This workflow needs more logic than a single shell command. Use the [Claude SDK](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) to run it.

1249 </CodeGroupItem>

13791250

1380 RESPONSE=$(curl https://api.anthropic.com/v1/messages \

1381 -H "x-api-key: $ANTHROPIC_API_KEY" \

1382 -H "anthropic-version: 2023-06-01" \

1383 -H "content-type: application/json" \

1384 -d "{

1385 \"model\": \"claude-opus-5-5\",

1386 \"max_tokens\": 4096,

1387 \"container\": {

1388 \"id\": \"$CONTAINER_ID\",

1389 \"skills\": [{

1390 \"type\": \"custom\",

1391 \"skill_id\": \"skill_01AbCdEfGhIjKlMnOpQrStUv\",

1392 \"version\": \"latest\"

1393 }]

1394 },

1395 \"messages\": [],

1396 \"tools\": [{

1397 \"type\": \"code_execution_20250825\",

1398 \"name\": \"code_execution\"

1399 }]

1400 }")

1401 ```

1402

1403 ```bash CLI

1404 RESP=$(mktemp)

1405

1406 # Initial request: capture the full JSON response to a temp file

1407 ant messages create > "$RESP" <<'YAML'

1408 model: claude-opus-5-5

1409 max_tokens: 4096

1410 container:

1411 skills:

1412 - type: custom

1413 skill_id: skill_01AbCdEfGhIjKlMnOpQrStUv

1414 version: latest

1415 messages:

1416 - role: user

1417 content: Generate and process a large sample dataset

1418 tools:

1419 - type: code_execution_20250825

1420 name: code_execution

1421 YAML

1422

1423 # If stop_reason is "pause_turn", continue in the same container,

1424 # appending the prior response's content array to messages as the

1425 # assistant turn. Repeat until stop_reason is no longer "pause_turn".

1426 CONTAINER_ID=$(jq -r '.container.id' "$RESP")

1427

1428 ant messages create > "$RESP" <<YAML

1429 model: claude-opus-5-5

1430 max_tokens: 4096

1431 container:

1432 id: $CONTAINER_ID

1433 skills:

1434 - type: custom

1435 skill_id: skill_01AbCdEfGhIjKlMnOpQrStUv

1436 version: latest

1437 messages: [] # replace with conversation history + prior assistant content

1438 tools:

1439 - type: code_execution_20250825

1440 name: code_execution

1441 YAML

1442 ```

1443

14441251 ```python Python

14451252 client = anthropic.Anthropic()

14461253

from line 2525

27182525 ```

27192526

27202527 ```bash CLI

2721 ant skills delete --skill-id skill_01AbCdEfGhIjKlMnOpQrStUv >/dev/null

2528 ant skills delete --skill-id skill_01AbCdEfGhIjKlMnOpQrStUv

27222529 ```

27232530

27242531 ```python Python

from line 2601

27942601<CodeGroup>

27952602 ```bash cURL

27962603 # Create a new version

2797 NEW_VERSION=$(curl -X POST "https://api.anthropic.com/v1/skills/skill_01AbCdEfGhIjKlMnOpQrStUv/versions" \

2604 curl -X POST "https://api.anthropic.com/v1/skills/skill_01AbCdEfGhIjKlMnOpQrStUv/versions" \

27982605 -H "x-api-key: $ANTHROPIC_API_KEY" \

27992606 -H "anthropic-version: 2023-06-01" \

28002607 -F "files[]=@financial_skill/SKILL.md;filename=financial_skill/SKILL.md" \

2801 -F "files[]=@financial_skill/analyze.py;filename=financial_skill/analyze.py")

2608 -F "files[]=@financial_skill/analyze.py;filename=financial_skill/analyze.py"

28022609

2803 VERSION_ID=$(echo "$NEW_VERSION" | jq -r '.id')

2804

2805 # Use specific version

2610 # Use a specific version: the id from the create response

28062611 curl https://api.anthropic.com/v1/messages \

28072612 -H "x-api-key: $ANTHROPIC_API_KEY" \

28082613 -H "anthropic-version: 2023-06-01" \

28092614 -H "content-type: application/json" \

2810 -d "{

2811 \"model\": \"claude-opus-5-5\",

2812 \"max_tokens\": 4096,

2813 \"container\": {

2814 \"skills\": [{

2815 \"type\": \"custom\",

2816 \"skill_id\": \"skill_01AbCdEfGhIjKlMnOpQrStUv\",

2817 \"version\": \"$VERSION_ID\"

2615 -d '{

2616 "model": "claude-opus-5-5",

2617 "max_tokens": 4096,

2618 "container": {

2619 "skills": [{

2620 "type": "custom",

2621 "skill_id": "skill_01AbCdEfGhIjKlMnOpQrStUv",

2622 "version": "'"$VERSION_ID"'"

28182623 }]

28192624 },

2820 \"messages\": [{\"role\": \"user\", \"content\": \"Use updated Skill\"}],

2821 \"tools\": [{\"type\": \"code_execution_20250825\", \"name\": \"code_execution\"}]

2822 }"

2625 "messages": [{"role": "user", "content": "Use updated Skill"}],

2626 "tools": [{"type": "code_execution_20250825", "name": "code_execution"}]

2627 }'

28232628

28242629 # Use latest version

28252630 curl https://api.anthropic.com/v1/messages \

from line 2648

28432648

28442649 ```bash CLI

28452650 # Create a new version

2846 VERSION_ID=$(ant skills:versions create \

2651 ant skills:versions create \

28472652 --skill-id skill_01AbCdEfGhIjKlMnOpQrStUv \

2848 --file financial_skill.zip \

2849 --transform id \

2850 --raw-output)

2653 --file financial_skill.zip

28512654

2852 # Use specific version

2655 # Use a specific version: the id from the create response

28532656 ant messages create <<YAML

28542657 model: claude-opus-5-5

28552658 max_tokens: 4096

from line 4269

44664269

44674270Handle Skill-related errors gracefully:

44684271

4469<CodeGroup exclude="shell:cURL">

4272<CodeGroup exclude="shell:cURL, shell:CLI">

44704273 <CodeGroupItem language="cURL">

44714274 This error-handling flow needs more logic than a single shell command, so use the Claude SDK for it. A request that fails because of a Skill problem returns HTTP 400. The `error.message` field in the JSON response body describes the problem.

44724275 </CodeGroupItem>

44734276

4474 ```bash CLI

4475 if ! RESULT=$(ant messages create \

4476 --transform-error error.message \

4477 --format-error yaml 2>&1 <<'YAML'

4478 model: claude-opus-5-5

4479 max_tokens: 4096

4480 container:

4481 skills:

4482 - type: custom

4483 skill_id: skill_01AbCdEfGhIjKlMnOpQrStUv

4484 version: latest

4485 messages:

4486 - role: user

4487 content: Process data

4488 tools:

4489 - type: code_execution_20250825

4490 name: code_execution

4491 YAML

4492 ); then

4493 case "$RESULT" in

4494 *skill*)

4495 printf 'Skill error: %s\n' "$RESULT"

4496 # Handle skill-specific errors

4497 ;;

4498 *)

4499 printf '%s\n' "$RESULT" >&2

4500 exit 1

4501 ;;

4502 esac

4503 fi

4504 ```

4277 <CodeGroupItem language="CLI">

4278 This workflow needs more logic than a single shell command. Use the [Claude SDK](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) to run it.

4279 </CodeGroupItem>

45054280

45064281 ```python Python

45074282 client = anthropic.Anthropic()

build-with-claude/streaming Changed · +2 / -3 lines

from line 12

1212

1313<CodeGroup exclude="shell:cURL">

1414 ```bash CLI

15 ant messages create --stream --format jsonl \

15 ant messages create --stream \

1616 --model claude-opus-5-5 \

1717 --max-tokens 1024 \

18 --message '{role: user, content: "Hello"}' \

19 | jq -rj 'select(.delta.type? == "text_delta") | .delta.text'

18 --message '{role: user, content: "Hello"}'

2019 ```

2120

2221 ```python Python

build-with-claude/structured-outputs Changed · +23 / -25 lines

from line 124

124124

125125 <Tab title="CLI">

126126 ```bash

127 ant messages create \

128 --transform 'content.#(type=="text").text|@fromstr' \

129 --format jsonl <<'YAML'

127 ant messages create <<'YAML'

130128 model: claude-opus-5-5

131129 max_tokens: 1024

132130 messages:

from line 148

150148 YAML

151149 ```

152150

153 To print only some properties of the JSON output, pass a [GJSON path](https://platform.claude.com/docs/en/cli-sdks-libraries/cli/using#transform-output-with-gjson) to `--transform`.

151 Claude returns JSON like this in the response's text content block:

154152

155 The example above outputs:

156

157 ```text Output wrap

158 {"name":"John Smith","email":"[email protected]","plan_interest":"Enterprise","demo_requested":true}

153 ```json Output

154 {

155 "name": "John Smith",

156 "email": "[email protected]",

157 "plan_interest": "Enterprise",

158 "demo_requested": true

159 }

159160 ```

160161 </Tab>

161162

from line 803

802803

803804 <Tab title="CLI">

804805 ```bash

805 ant messages create \

806 --transform 'content.#(type=="text").text|@fromstr' \

807 --format jsonl <<'YAML'

806 ant messages create <<'YAML'

808807 model: claude-opus-5-5

809808 max_tokens: 1024

810809 messages:

from line 827

828827 YAML

829828 ```

830829

831 The example above outputs:

830 Claude returns JSON like this in the response's text content block:

832831

833 ```text Output wrap

834 {"name":"John Smith","email":"[email protected]","plan_interest":"Enterprise","demo_requested":true}

832 ```json Output

833 {

834 "name": "John Smith",

835 "email": "[email protected]",

836 "plan_interest": "Enterprise",

837 "demo_requested": true

838 }

835839 ```

836840 </Tab>

837841

from line 1241

12371241 ```

12381242

12391243 ```bash CLI

1240 ant messages create \

1241 --transform 'content.#(type=="text").text|@fromstr' \

1242 --format jsonl <<'YAML'

1244 ant messages create <<'YAML'

12431245 model: claude-opus-5-5

12441246 max_tokens: 4096

12451247 messages:

from line 1569

15671569 ```

15681570

15691571 ```bash CLI

1570 ant messages create \

1571 --transform 'content.#(type=="text").text|@fromstr' \

1572 --format jsonl <<'YAML'

1572 ant messages create <<'YAML'

15731573 model: claude-opus-5-5

15741574 max_tokens: 1024

15751575 messages:

from line 1857

18571857 ```

18581858

18591859 ```bash CLI

1860 ant messages create \

1861 --transform 'content.#(type=="text").text' \

1862 --raw-output <<'YAML'

1860 ant messages create <<'YAML'

18631861 model: claude-opus-5-5

18641862 max_tokens: 1024

18651863 output_config:

build-with-claude/thinking Changed · +2 / -4 lines

from line 101

101101 --model claude-opus-5-5 \

102102 --max-tokens 16000 \

103103 --thinking '{type: adaptive, display: summarized}' \

104 --message '{role: user, content: "What is the greatest common divisor of 1071 and 462?"}' \

105 --transform content \

106 --format yaml

104 --message '{role: user, content: "What is the greatest common divisor of 1071 and 462?"}'

107105 ```

108106

109107 ```python Python

from line 307

309307 ```

310308</CodeGroup>

311309

312Running the example prints the summarized thinking, then the answer:

310The response carries the summarized thinking, then the answer:

313311

314312```text Output wrap

315313Thinking: Use Euclidean algorithm.

build-with-claude/thinking-tool-workflows Changed · +6 / -64 lines

from line 55

5555 ```

5656

5757 ```bash CLI

58 ant messages create --transform content <<'YAML'

58 ant messages create <<'YAML'

5959 model: claude-opus-5-5

6060 max_tokens: 16000

6161 thinking:

from line 313

313313

314314 Each sample is a self-contained script: it repeats the first request, then immediately sends the follow-up using the response it just received.

315315

316 <CodeGroup exclude="shell:cURL">

316 <CodeGroup exclude="shell:cURL, shell:CLI">

317317 <CodeGroupItem language="cURL">

318 This workflow needs more logic than a single shell command. Use the Claude SDK to run it.

318 This workflow needs more logic than a single shell command. Use the [Claude SDK](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) to run it.

319319 </CodeGroupItem>

320320

321 ```bash CLI

322 # First turn: write the assistant content array (thinking and tool_use

323 # blocks, signatures intact) to a file. Routing model-generated text

324 # through a file keeps it out of shell-expansion position later.

325 ant messages create --transform content --format jsonl \

326 > assistant_content.json <<'YAML'

327 model: claude-opus-5-5

328 max_tokens: 16000

329 thinking:

330 type: adaptive

331 tools:

332 - name: get_weather

333 description: Get current weather for a location

334 input_schema:

335 type: object

336 properties:

337 location:

338 type: string

339 description: City name

340 required: [location]

341 messages:

342 - role: user

343 content: What's the weather in Paris?

344 YAML

345

346 # Second turn: jq fills the two null placeholders from the captured file,

347 # so the blocks return verbatim as the assistant message. The thinking

348 # block MUST accompany the tool_use block. The quoted delimiter keeps the

349 # shell from expanding anything in the body.

350 jq --slurpfile blocks assistant_content.json '

351 .messages[1].content = $blocks[0] |

352 .messages[2].content[0].tool_use_id =

353 ($blocks[0][] | select(.type == "tool_use") | .id)

354 ' <<'JSON' | ant messages create

355 {

356 "model": "claude-opus-5-5",

357 "max_tokens": 16000,

358 "thinking": {"type": "adaptive"},

359 "tools": [{

360 "name": "get_weather",

361 "description": "Get current weather for a location",

362 "input_schema": {

363 "type": "object",

364 "properties": {

365 "location": {"type": "string", "description": "City name"}

366 },

367 "required": ["location"]

368 }

369 }],

370 "messages": [

371 {"role": "user", "content": "What's the weather in Paris?"},

372 {"role": "assistant", "content": null},

373 {"role": "user", "content": [{

374 "type": "tool_result",

375 "tool_use_id": null,

376 "content": "Current temperature: 88°F"

377 }]}

378 ]

379 }

380 JSON

381 ```

321 <CodeGroupItem language="CLI">

322 This workflow needs more logic than a single shell command. Use the [Claude SDK](https://platform.claude.com/docs/en/cli-sdks-libraries/overview) to run it.

323 </CodeGroupItem>

382324

383325 ```python Python

384326

build-with-claude/token-counting Changed · +3 / -6 lines

from line 479

479479 ```bash cURL

480480 #!/bin/sh

481481

482 IMAGE_URL="https://platform.claude.com/docs/images/vision-example.jpg"

483 IMAGE_MEDIA_TYPE="image/jpeg"

484 IMAGE_BASE64=$(curl -s "$IMAGE_URL" | base64 | tr -d '\n')

482 IMAGE_BASE64=$(curl -s "https://platform.claude.com/docs/images/vision-example.jpg" | base64 | tr -d '\n')

485483

486484 curl https://api.anthropic.com/v1/messages/count_tokens \

487485 -H "x-api-key: $ANTHROPIC_API_KEY" \

from line 492

494492 {"role": "user", "content": [

495493 {"type": "image", "source": {

496494 "type": "base64",

497 "media_type": "$IMAGE_MEDIA_TYPE",

495 "media_type": "image/jpeg",

498496 "data": "$IMAGE_BASE64"

499497 }},

500498 {"type": "text", "text": "Describe this image"}

from line 503

505503 ```

506504

507505 ```bash CLI

508 IMAGE_URL="https://platform.claude.com/docs/images/vision-example.jpg"

509 curl -s "$IMAGE_URL" -o ./vision-example.jpg

506 curl -s "https://platform.claude.com/docs/images/vision-example.jpg" -o ./vision-example.jpg

510507

511508 ant messages count-tokens <<'YAML'

512509 model: claude-opus-5-5

build-with-claude/vision Changed · +9 / -11 lines

from line 538

538538<CodeGroup>

539539 ```bash cURL

540540 # First, upload your image to the Files API

541 FILE_ID=$(curl -sS -X POST https://api.anthropic.com/v1/files \

541 curl -sS -X POST https://api.anthropic.com/v1/files \

542542 -H "x-api-key: $ANTHROPIC_API_KEY" \

543543 -H "anthropic-version: 2023-06-01" \

544 -F "[email protected]" | jq -r '.id')

544 -F "[email protected]"

545545

546 # Then use the returned file_id in your message

546 # Then use the file_id from the upload response in your message

547547 curl https://api.anthropic.com/v1/messages \

548548 -H "x-api-key: $ANTHROPIC_API_KEY" \

549549 -H "anthropic-version: 2023-06-01" \

from line 577

577577 https://platform.claude.com/docs/images/vision-example.jpg

578578

579579 # First, upload your image to the Files API

580 FILE_ID=$(ant files upload \

581 --file ./vision-example.jpg \

582 --transform id --raw-output)

580 ant files upload \

581 --file ./vision-example.jpg

583582

584 # Then use the returned file_id in your message

585 ant messages create \

586 --transform content --format yaml <<YAML

583 # Then use the file_id from the upload response in your message

584 ant messages create <<YAML

587585 model: claude-opus-5-5

588586 max_tokens: 1024

589587 messages:

build-with-claude/working-with-messages Changed · +5 / -9 lines

from line 508

508508 #!/bin/sh

509509

510510 # Option 1: Base64-encoded image

511 IMAGE_URL="https://platform.claude.com/docs/images/vision-example.jpg"

512 IMAGE_MEDIA_TYPE="image/jpeg"

513 IMAGE_BASE64=$(curl "$IMAGE_URL" | base64 | tr -d '\n')

511 IMAGE_BASE64=$(curl "https://platform.claude.com/docs/images/vision-example.jpg" | base64 | tr -d '\n')

514512

515513 curl https://api.anthropic.com/v1/messages \

516514 -H "x-api-key: $ANTHROPIC_API_KEY" \

from line 522

524522 {"role": "user", "content": [

525523 {"type": "image", "source": {

526524 "type": "base64",

527 "media_type": "$IMAGE_MEDIA_TYPE",

525 "media_type": "image/jpeg",

528526 "data": "$IMAGE_BASE64"

529527 }},

530528 {"type": "text", "text": "What is in the above image?"}

from line 552

554552 ```

555553

556554 ```bash CLI

557 IMAGE_URL="https://platform.claude.com/docs/images/vision-example.jpg"

558

559555 # Option 1: Base64-encoded image (CLI auto-encodes binary @file refs)

560 curl -s "$IMAGE_URL" -o ./vision-example.jpg

556 curl -s "https://platform.claude.com/docs/images/vision-example.jpg" -o ./vision-example.jpg

561557

562558 ant messages create <<'YAML'

563559 model: claude-opus-5-5

from line 571

575571 YAML

576572

577573 # Option 2: URL-referenced image

578 ant messages create <<YAML

574 ant messages create <<'YAML'

579575 model: claude-opus-5-5

580576 max_tokens: 1024

581577 messages:

from line 580

584580 - type: image

585581 source:

586582 type: url

587 url: $IMAGE_URL

583 url: https://platform.claude.com/docs/images/vision-example.jpg

588584 - type: text

589585 text: What is in the above image?

590586 YAML

claude_api_primer Changed · +8 / -71 lines

from line 105

105105You can prefill part of Claude's response in the last position of the input messages list. Use this technique to shape Claude's response. The following example uses `"max_tokens": 1` to get a single multiple choice answer from Claude.

106106

107107<Note>

108 Claude 4.6 and later models and Claude Mythos Preview do not support assistant message prefill; requests to those models must end with a user message. The examples below use a model that supports prefill.

108 Claude 4.6 and later models and Claude Mythos Preview do not support assistant message prefill; requests to those models must end with a user message. The following examples use a model that supports prefill.

109109</Note>

110110

111111<CodeGroup exclude="shell:cURL, typescript, csharp, go, java, php, ruby">

from line 145

145145

146146<CodeGroup exclude="shell:cURL, typescript, csharp, go, java, php, ruby">

147147 ```bash CLI

148 IMAGE_URL="https://platform.claude.com/docs/images/vision-example.jpg"

149

150148 # Option 1: Base64-encoded image (@ prefix auto-encodes binary files as base64)

151 curl -sSo vision-example.jpg "$IMAGE_URL"

149 curl -sSo vision-example.jpg https://platform.claude.com/docs/images/vision-example.jpg

152150

153151 ant messages create <<'YAML'

154152 model: claude-opus-5-5

from line 164

166164 YAML

167165

168166 # Option 2: URL-referenced image

169 ant messages create <<YAML

167 ant messages create <<'YAML'

170168 model: claude-opus-5-5

171169 max_tokens: 1024

172170 messages:

from line 173

175173 - type: image

176174 source:

177175 type: url

178 url: $IMAGE_URL

176 url: https://platform.claude.com/docs/images/vision-example.jpg

179177 - type: text

180178 text: What is in the above image?

181179 YAML

from line 270

272270

273271<CodeGroup exclude="shell:cURL, typescript, csharp, go, java, php, ruby">

274272 ```bash CLI

275 ant messages create --transform content --format yaml <<'YAML'

273 ant messages create <<'YAML'

276274 model: claude-opus-5-5

277275 max_tokens: 16000

278276 thinking:

from line 322

324322

325323### Preserving thinking blocks

326324

327<CodeGroup exclude="shell:cURL, typescript, csharp, go, java, php, ruby">

328 ```bash CLI

329 # First request: capture the assistant content array (thinking + tool_use

330 # blocks, signatures intact) as compact JSON.

331 ASSISTANT_CONTENT=$(ant messages create \

332 --transform content --format jsonl <<'YAML'

333 model: claude-opus-5-5

334 max_tokens: 16000

335 thinking:

336 type: adaptive

337 display: summarized

338 tools:

339 - name: get_weather

340 description: Get the current weather for a location.

341 input_schema:

342 type: object

343 properties:

344 location:

345 type: string

346 description: The city name.

347 required: [location]

348 messages:

349 - role: user

350 content: "What's the weather in Paris?"

351 YAML

352 )

353

354 TOOL_USE_ID=$(printf '%s' "$ASSISTANT_CONTENT" \

355 | jq -r '.[] | select(.type == "tool_use") | .id')

356

357 # Second request: pass the captured blocks back unchanged as the assistant

358 # message. The thinking block must accompany the tool_use block.

359 ant messages create <<YAML

360 model: claude-opus-5-5

361 max_tokens: 16000

362 thinking:

363 type: adaptive

364 display: summarized

365 tools:

366 - name: get_weather

367 description: Get the current weather for a location.

368 input_schema:

369 type: object

370 properties:

371 location:

372 type: string

373 description: The city name.

374 required: [location]

375 messages:

376 - role: user

377 content: "What's the weather in Paris?"

378 - role: assistant

379 content: $ASSISTANT_CONTENT

380 - role: user

381 content:

382 - type: tool_result

383 tool_use_id: $TOOL_USE_ID

384 content: "Current temperature: 72°F"

385 YAML

386 ```

387

325<CodeGroup exclude="shell:cURL, shell:CLI, typescript, csharp, go, java, php, ruby">

388326 ```python Python

389327 import anthropic

390328

from line 664

726664

727665<CodeGroup exclude="shell:cURL, typescript, csharp, go, java, php, ruby">

728666 ```bash CLI

729 ant messages create --stream --format jsonl \

667 ant messages create --stream \

730668 --model claude-opus-5-5 \

731669 --max-tokens 1024 \

732 --message '{role: user, content: "Hello"}' \

733 | jq -rj 'select(.delta.type? == "text_delta") | .delta.text'

670 --message '{role: user, content: "Hello"}'

734671 ```

735672

736673 ```python Python

cli-sdks-libraries/cli/using Changed · +1 / -8 lines

from line 89

8989 --name "My Agent" \

9090 --model '{id: claude-opus-5-5}' \

9191 --transform id --raw-output)

92

93printf '%s\n' "$AGENT_ID"

9492```

9593

96```text Output wrap

97agent_011CYm1BLqPXpQRk5khsSXrs

98```

99

10094<Note>

10195 `--raw-output` is distinct from `--format raw`. `--raw-output` strips JSON quotes from string results, like `jq -r`. `--format raw` prints the response body's raw JSON bytes without auto-paginating; on list endpoints it applies `--transform` to the pagination envelope rather than to each item.

10296</Note>

from line 167

173167 --message '{role: user, content: [

174168 {type: document, source: {type: base64, media_type: application/pdf, data: "@./scan.pdf"}},

175169 {type: text, text: "Extract the text from this scanned document."}

176 ]}' \

177 --transform 'content.#(type=="text").text' --raw-output

170 ]}'

178171```

179172

180173The CLI detects the file type and encodes binary files as base64 automatically. To force a specific encoding use `@file://` for plain text or `@data://` for base64. Escape a literal leading `@` with a backslash (`\@username`).

manage-claude/admin-api Changed · +20 / -22 lines

## Availability

from line 4

44description: Manage organization members, workspaces, invites, and API keys programmatically with the Admin API, using an Admin API key, an `org:admin` OAuth token, or a personal or service account key.

55---

66

7<Tip>

8 **The Admin API is unavailable for individual accounts.** To collaborate with teammates and add members, set up your organization on the [Organization](https://platform.claude.com/settings/organization) page (`platform.claude.com/settings/organization`) in the Claude Console.

9</Tip>

10

117The [Admin API](https://platform.claude.com/docs/en/api/organization) lets you manage your organization's members, workspaces, invites, and API keys programmatically instead of by hand in the [Claude Console](https://platform.claude.com/).

128

13<Check>

14 **The Admin API requires special access**

9## Availability

1510

16 The Admin API accepts three credentials:

11The Admin API is unavailable for individual accounts. To collaborate with teammates and add members, set up your organization on the [Organization](https://platform.claude.com/settings/organization) page (`platform.claude.com/settings/organization`) in the Claude Console.

1712

18 * An **Admin API key** (starting with `sk-ant-admin...`) sent in the `x-api-key` header. Only organization members with the admin role can provision one. See [Create an Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys).

19 * An **OAuth bearer token** with the `org:admin` scope sent in the `authorization: Bearer` header. Only members with the admin, owner, or primary owner role can obtain one. See [Obtain an OAuth bearer token](https://platform.claude.com/docs/en/manage-claude/admin-api#oauth-bearer-token).

20 * A **personal key** or **service account key** that isn't scoped to a specific workspace, sent in the `x-api-key` header. The key has the same permissions as the linked account. See [Key types](https://platform.claude.com/docs/en/manage-claude/authentication#key-types).

21</Check>

13Claude Enterprise (claude.ai) organizations call the Admin API with a scoped API key created in claude.ai. From this page, only the members and invites endpoints apply to them. They also get Enterprise-only endpoints: group and custom-role reads, and [spend limits](https://platform.claude.com/docs/en/manage-claude/spend-limits-api). The [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api), also Enterprise-only, is in beta. See [User management](https://platform.claude.com/docs/en/manage-claude/user-management).

2214

23<Note>

24 **Claude Enterprise:** Claude Enterprise (claude.ai) organizations call the Admin API with a scoped API key created in claude.ai. From this page, only the members and invites endpoints apply to them. They also get Enterprise-only endpoints: group and custom-role reads, and [spend limits](https://platform.claude.com/docs/en/manage-claude/spend-limits-api). See [User management](https://platform.claude.com/docs/en/manage-claude/user-management).

25</Note>

15On [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws), only these Admin API endpoints are available:

2616

27<Note>

28 **Claude Platform on AWS:** Only the workspace endpoints (create, get, list, update, and archive on `/v1/organizations/workspaces`), the external key endpoints (register, get, list, update, and delete on `/v1/organizations/external_keys`, for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws); there is no validate endpoint, because keys are validated when attached to a workspace), and the [telemetry destination endpoints](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#telemetry-destinations) are available on Claude Platform on AWS. Organization members, workspace members, invites, API keys, and the usage, cost, and rate limit reports aren't. See [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws).

29</Note>

17* The workspace endpoints: create, get, list, update, and archive on `/v1/organizations/workspaces`.

18* The external key endpoints, for [CMEK](https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws): register, get, list, update, and delete on `/v1/organizations/external_keys`. There is no validate endpoint, because keys are validated when attached to a workspace.

19* The [telemetry destination endpoints](https://platform.claude.com/docs/en/api/claude-platform-on-aws-iam-actions#telemetry-destinations).

3020

21Organization members, workspace members, invites, API keys, and the usage, cost, and rate limit reports aren't available on Claude Platform on AWS.

22

3123## Authentication

3224

33Authenticate with any of the three credentials. An Admin API key covers most endpoints. The service-account, federation-issuer, and federation-rule endpoints accept only an `org:admin` OAuth token. Send a personal key or service account key in the `x-api-key` header, as you would an Admin API key. The following examples call the [organization info endpoint](https://platform.claude.com/docs/en/manage-claude/admin-api#accessing-organization-info) with an OAuth token and with an Admin API key.

25The Admin API accepts any of these three credentials:

26

27* An **Admin API key** (starting with `sk-ant-admin...`) sent in the `x-api-key` header. Only organization members with the admin role can provision one. See [Create an Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys).

28* An **OAuth bearer token** with the `org:admin` scope sent in the `authorization: Bearer` header. Only members with the admin, owner, or primary owner role can obtain one. See [Obtain an OAuth bearer token](https://platform.claude.com/docs/en/manage-claude/admin-api#oauth-bearer-token).

29* A **personal key** or **service account key** that isn't scoped to a specific workspace, sent in the `x-api-key` header. The key has the same permissions as the linked account. See [Key types](https://platform.claude.com/docs/en/manage-claude/authentication#key-types).

30

31An Admin API key covers most endpoints. The service-account, federation-issuer, and federation-rule endpoints accept only an `org:admin` OAuth token. Send a personal key or service account key in the `x-api-key` header, as you would an Admin API key. The following examples call the [organization info endpoint](https://platform.claude.com/docs/en/manage-claude/admin-api#accessing-organization-info) with an OAuth token and with an Admin API key.

3432

3533The Python, TypeScript, C#, Go, Java, PHP, and Ruby SDKs expose the endpoints on this page under `client.organization` (csharp, go: `client.Organization`; java: `client.organization()`; php: `$client->organization`), and the `ant` CLI under `ant organization`. The examples on this page use the default client, which reads an Admin API key from `ANTHROPIC_API_KEY` or an OAuth bearer token from `ANTHROPIC_AUTH_TOKEN`. SDK list methods in Python, TypeScript, C#, Go, and Java return an iterator that fetches more pages on demand, so `limit` sets the page size, not the total. The PHP, Ruby, and curl examples return one page. In the CLI, `--limit` caps the results on the member, invite, workspace, workspace-member, and API-key lists. For each endpoint's parameters and responses, see the [Admin API reference](https://platform.claude.com/docs/en/api/organization).

3634

manage-claude/admin-api-keys Changed · +9 / -5 lines

from line 4

44description: Create an Admin API key for your Claude Console or Claude Enterprise organization.

55---

66

7An Admin API key authenticates every API in the **Admin** section of this guide: the [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api), [Analytics APIs](https://platform.claude.com/docs/en/manage-claude/analytics-api), [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api), [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api), [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api), and [Rate Limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api). You do not need a separate key for each API. The one exception is the Admin API's service-account, federation-issuer, and federation-rule endpoints, which accept only an OAuth bearer token with the `org:admin` scope. See [Obtain an OAuth bearer token](https://platform.claude.com/docs/en/manage-claude/admin-api#oauth-bearer-token).

7An Admin API key authenticates every API in the **Admin** section of this guide: the [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api), [Analytics APIs](https://platform.claude.com/docs/en/manage-claude/analytics-api), [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api), [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api), [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api), [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api), and [Rate Limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api). You do not need a separate key for each API. The one exception is the Admin API's service-account, federation-issuer, and federation-rule endpoints, which accept only an OAuth bearer token with the `org:admin` scope. See [Obtain an OAuth bearer token](https://platform.claude.com/docs/en/manage-claude/admin-api#oauth-bearer-token).

88

99Where you create the key depends on which Claude product your organization uses.

1010

1111## Which key do you need?

1212

14| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

15| **Claude Console** (Claude Platform, `platform.claude.com`) | [Admin keys](https://platform.claude.com/settings/admin-keys) page (`platform.claude.com/settings/admin-keys`) in the Claude Console | `sk-ant-admin01-...` | Organization members with the **admin** role | [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api), [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api), [Rate Limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api), [Claude Code Analytics API](https://platform.claude.com/docs/en/manage-claude/claude-code-analytics-api), and the Compliance API [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) |

16| **Claude Enterprise** (`claude.ai`) | [claude.ai > Organization settings > API](https://claude.ai/admin-settings/api-access) | `sk-ant-api01-...` | The parent organization's **primary owner** (all linked organizations). An **organization owner** can create one carrying Compliance API scopes only, restricted to their own organization | [User management](https://platform.claude.com/docs/en/manage-claude/user-management) (the Admin API's member, invite, and group endpoints), [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api), [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api), and [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api), according to the [scopes](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#choose-scopes-for-a-claude-enterprise-key) you select |

14| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

15| **Claude Console** (Claude Platform, `platform.claude.com`) | [Admin keys](https://platform.claude.com/settings/admin-keys) page (`platform.claude.com/settings/admin-keys`) in the Claude Console | `sk-ant-admin01-...` | Organization members with the **admin** role | [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api), [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api), [Rate Limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api), [Claude Code Analytics API](https://platform.claude.com/docs/en/manage-claude/claude-code-analytics-api), and the Compliance API [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) |

16| **Claude Enterprise** (`claude.ai`) | [claude.ai > Organization settings > API](https://claude.ai/admin-settings/api-access) | `sk-ant-api01-...` | The parent organization's **primary owner** (all linked organizations). An **organization owner** can create one carrying Compliance API scopes only, restricted to their own organization | [User management](https://platform.claude.com/docs/en/manage-claude/user-management) (the Admin API's member, invite, and group endpoints), [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api), [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api), [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api), and [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api), according to the [scopes](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#choose-scopes-for-a-claude-enterprise-key) you select |

1717

1818A key created in one organization cannot be used to manage a different organization. If your company uses both Claude Console and Claude Enterprise, create one key in each.

1919

from line 67

6767| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): change member roles, remove members, create and withdraw invites (to assign the `managed` role on a role change or an invite, also select `write:rbac_groups`) | `write:members` |

6868| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): read groups and their members | `read:rbac_groups` |

6969| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): create, rename, and delete groups; add and remove group members; with `write:members`, assign the `managed` role (on an invite or a role change) or assign groups on an invite | `write:rbac_groups` |

70| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): read plugins, versions, installation settings, shares, and marketplaces; download plugin files, including the files of members' personal plugins; validate a marketplace before you connect it | `read:plugins` |

71| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): upload plugins and versions; choose which version members are served; delete plugins, including members' personal plugins; set and remove installation settings; set a marketplace's default installation setting; validate a marketplace before you connect it (to read plugins, also select `read:plugins`) | `write:plugins` |

7072| [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api): read members' effective spend limits and increase requests | `read:spend_limits` |

7173| [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api): set or clear per-user spend limits; approve or deny increase requests | `write:spend_limits` |

7274| [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api): engagement, adoption, cost, and usage reports | `read:analytics` |

from line 79

7779| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management) read endpoints and every Compliance API read endpoint, with a single read-only scope (for security-audit integrations; does not include the Spend Limits or Analytics APIs) | `read:org_audit` |

7880

7981The Compliance and Analytics APIs must be enabled for your organization before keys with those scopes can be used. See [Set up the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access#set-up-the-compliance-api) and [Get access to the Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api#get-access-to-the-claude-enterprise-analytics-api).

82

83You can create and use keys with `read:plugins` or `write:plugins` only if your organization can use the Plugins API. The [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api) guide says which organizations can use it. In those organizations, keys with `read:org_audit` or `read:compliance_org_data` can also call the Plugins API's read endpoints, including file downloads, but not marketplace validation. The `read:plugins` and `write:plugins` scopes act only on the organization the key was created in. See [Plugins API scopes](https://platform.claude.com/docs/en/manage-claude/plugins-api#scopes) and [Reading another organization under the same parent](https://platform.claude.com/docs/en/manage-claude/plugins-api#reading-another-organization-under-the-same-parent).

8084

8185## Use the key

8286

manage-claude/compliance-activity-feed Changed · +5 / -5 lines

from line 99

9999</Note>

100100

101101```bash cURL

102# Fetch the first page (newest activities first) and capture its trailing cursor.

103last_id=$(curl --fail-with-body -sS \

102# Fetch the first page (newest activities first).

103curl --fail-with-body -sS \

104104 "https://api.anthropic.com/v1/compliance/activities?limit=2" \

105105 --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \

106 --header "anthropic-version: 2023-06-01" | jq -er '.last_id')

106 --header "anthropic-version: 2023-06-01"

107107

108# Pass the cursor back unchanged to fetch the next (older) page.

108# LAST_ID is the last_id from the first response. Pass it back unchanged to fetch the next (older) page.

109109curl --fail-with-body -sS -G \

110110 "https://api.anthropic.com/v1/compliance/activities" \

111111 --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \

112112 --header "anthropic-version: 2023-06-01" \

113113 --data-urlencode "limit=2" \

114 --data-urlencode "after_id=${last_id}"

114 --data-urlencode "after_id=$LAST_ID"

115115```

116116

117117A production **backfill** loop pages through older activities by driving iteration off `has_more` and `last_id`:

manage-claude/compliance-content-data Changed · +4 / -12 lines

from line 84

8484The list response carries chat metadata only. To pull the actual chat content, attached files, and inline artifacts (structured documents Claude generates inside a chat), follow up with the messages endpoint for each chat ID:

8585

8686```bash cURL

87chat_id="claude_chat_01H5CWunD7RpVJ5bHa8RCkja"

88

8987curl --fail-with-body -sS \

90 "https://api.anthropic.com/v1/compliance/apps/chats/$chat_id/messages" \

88 "https://api.anthropic.com/v1/compliance/apps/chats/claude_chat_01H5CWunD7RpVJ5bHa8RCkja/messages" \

9189 --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \

9290 --header "anthropic-version: 2023-06-01"

9391```

from line 193

195193* `Transfer-Encoding: chunked` is always set.

196194

197195```bash cURL

198file_id="claude_file_01UaT9wBcDfGhJkLmNpQrSv7"

199

200196curl --fail-with-body -sS \

201 "https://api.anthropic.com/v1/compliance/apps/chats/files/$file_id/content" \

197 "https://api.anthropic.com/v1/compliance/apps/chats/files/claude_file_01UaT9wBcDfGhJkLmNpQrSv7/content" \

202198 --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \

203199 --header "anthropic-version: 2023-06-01" \

204200 --output "dashboard_mockup_v1.pdf"

from line 226

230226A consumer that walks the attachment list must branch on `type` and call the matching content endpoint for each entry. The following request lists one page of attachments; paginate by passing `next_page` back as the `page` parameter until `has_more` is `false`.

231227

232228```bash cURL

233project_id="claude_proj_01KGp4eZNug9ri4kE35RSppq"

234

235229curl --fail-with-body -sS -G \

236 "https://api.anthropic.com/v1/compliance/apps/projects/$project_id/attachments" \

230 "https://api.anthropic.com/v1/compliance/apps/projects/claude_proj_01KGp4eZNug9ri4kE35RSppq/attachments" \

237231 --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \

238232 --header "anthropic-version: 2023-06-01"

239233```

from line 283

289283# from `read:compliance_user_data` when the Compliance Access Key is created.

290284# Ensure you have explicit authorization before running this.

291285

292chat_id="claude_chat_01H5CWunD7RpVJ5bHa8RCkja"

293

294286curl --fail-with-body -sS -X DELETE \

295 "https://api.anthropic.com/v1/compliance/apps/chats/$chat_id" \

287 "https://api.anthropic.com/v1/compliance/apps/chats/claude_chat_01H5CWunD7RpVJ5bHa8RCkja" \

296288 --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \

297289 --header "anthropic-version: 2023-06-01"

298290```

manage-claude/compliance-integration-patterns Changed · +2 / -3 lines

from line 61

6161### Cursor-driven incremental reads

6262

6363```bash cURL

64first_id="activity_01XyDMpzjS89pFZXqSFUBDr6" # first_id from a previous response

65

64# before_id is the first_id from a previous response

6665curl --fail-with-body -sS -G \

6766 "https://api.anthropic.com/v1/compliance/activities" \

6867 --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \

6968 --header "anthropic-version: 2023-06-01" \

7069 --data-urlencode "limit=5000" \

71 --data-urlencode "before_id=$first_id"

70 --data-urlencode "before_id=activity_01XyDMpzjS89pFZXqSFUBDr6"

7271```

7372

7473Page through until `has_more` is `false`, then persist `first_id` from the final response and pass it unchanged as `before_id` on the next run to retrieve activities newer than the saved cursor. To walk in the opposite direction for a backfill, persist `last_id` and pass it as `after_id` instead. For the full cursor-vs-page-token reference and retry semantics, see [Paginate results](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed#paginate-results).

manage-claude/compliance-org-data Changed · +5 / -15 lines

from line 73

7373Results are sorted by organization join date ascending. Unlike the Activity Feed's `before_id`/`after_id` cursors (see [Paginate results](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed#paginate-results)), the directory endpoints paginate with a `next_page` token: when `has_more` is `true`, pass `next_page` back unchanged as the `page` query parameter on the next request.

7474

7575```bash cURL

76org_uuid="91012d09-e48b-438e-a489-1bebfd8fa6f9"

77

7876curl --fail-with-body -sS -G \

79 "https://api.anthropic.com/v1/compliance/organizations/$org_uuid/users" \

77 "https://api.anthropic.com/v1/compliance/organizations/91012d09-e48b-438e-a489-1bebfd8fa6f9/users" \

8078 -H "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \

8179 -H "anthropic-version: 2023-06-01" \

8280 --data-urlencode "limit=500"

from line 109

111109By default, the response lists only members who have set at least one of the two values. Pass `include_unset=true` to list every current member, with `null` for each value that is not set. To return specific members only, pass up to 10 user IDs in `user_ids[]`. Results paginate with `limit` (default 20, maximum 100) and `page`. As on the [organization users endpoint](https://platform.claude.com/docs/en/manage-claude/compliance-org-data#list-organization-users), pass `next_page` back unchanged as `page`; also send the same `include_unset` and `user_ids[]` values with every page, or the call returns [400 Bad Request](https://platform.claude.com/docs/en/manage-claude/compliance-errors#invalid-pagination-cursor). A page can hold fewer results than `limit`, or none, and still not be the last, so keep requesting pages until `next_page` is `null`.

112110

113111```bash cURL

114org_uuid="91012d09-e48b-438e-a489-1bebfd8fa6f9"

115

116112curl --fail-with-body -sS \

117 "https://api.anthropic.com/v1/compliance/organizations/$org_uuid/user_preferences" \

113 "https://api.anthropic.com/v1/compliance/organizations/91012d09-e48b-438e-a489-1bebfd8fa6f9/user_preferences" \

118114 -H "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \

119115 -H "anthropic-version: 2023-06-01"

120116```

from line 139

143139Both role endpoints require `read:compliance_org_data`. The list endpoint accepts the same `limit` and `page` parameters as the [organization users endpoint](https://platform.claude.com/docs/en/manage-claude/compliance-org-data#list-organization-users).

144140

145141```bash cURL

146org_uuid="91012d09-e48b-438e-a489-1bebfd8fa6f9"

147

148142curl --fail-with-body -sS \

149 "https://api.anthropic.com/v1/compliance/organizations/${org_uuid}/roles" \

143 "https://api.anthropic.com/v1/compliance/organizations/91012d09-e48b-438e-a489-1bebfd8fa6f9/roles" \

150144 -H "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \

151145 -H "anthropic-version: 2023-06-01"

152146```

from line 201

207201For each group ID, list its members:

208202

209203```bash cURL

210group_id="rbac_group_01P9qRsTuVwXyZa2BcDeFgHjK"

211

212204curl --fail-with-body -sS -G \

213 "https://api.anthropic.com/v1/compliance/groups/$group_id/members" \

205 "https://api.anthropic.com/v1/compliance/groups/rbac_group_01P9qRsTuVwXyZa2BcDeFgHjK/members" \

214206 -H "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \

215207 -H "anthropic-version: 2023-06-01"

216208```

from line 235

243235</Note>

244236

245237```bash cURL

246org_uuid="91012d09-e48b-438e-a489-1bebfd8fa6f9"

247

248238curl --fail-with-body -sS \

249 "https://api.anthropic.com/v1/compliance/organizations/$org_uuid/settings" \

239 "https://api.anthropic.com/v1/compliance/organizations/91012d09-e48b-438e-a489-1bebfd8fa6f9/settings" \

250240 -H "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \

251241 -H "anthropic-version: 2023-06-01"

252242```

manage-claude/compliance-sessions Changed · +6 / -10 lines

from line 5

55---

66

77<Note>

8 The endpoints on this page are available only to Claude Enterprise organizations. The local and remote session endpoints are stable for Cowork, Claude Code, and Claude for Microsoft 365 sessions. Coverage of sessions in Claude Science, Claude in Chrome, and the Claude add-ins for Google Docs, Google Sheets, and Google Slides is in beta. The endpoints work with the same Compliance Access Key and `read:compliance_user_data` scope as the [chat, file, and project endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-content-data); no new key, scope, setting, or client update is required. See [Set up the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access).

8 The endpoints on this page are available only to Claude Enterprise organizations. The local and remote session endpoints are stable for Cowork, Claude Code, and Claude for Microsoft 365 sessions. Coverage of sessions in Claude Science, the Claude add-ins for Google Docs, Google Sheets, and Google Slides, and Claude in Chrome is in beta. The endpoints work with the same Compliance Access Key and `read:compliance_user_data` scope as the [chat, file, and project endpoints](https://platform.claude.com/docs/en/manage-claude/compliance-content-data); no new key, scope, setting, or client update is required. See [Set up the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access).

99</Note>

1010

1111<Check>

from line 14

1414 **Prerequisite:** None for listing sessions organization-wide. To filter the remote session list (sessions in the cloud) to specific users, you need user IDs from [List organization users](https://platform.claude.com/docs/en/manage-claude/compliance-org-data#list-organization-users); the local session list has no user filter.

1515</Check>

1616

17The endpoints on this page expose transcripts of the sessions your users run in Claude apps and agents (today: Cowork, Claude Code, Claude Science, Claude for Microsoft 365, Claude in Chrome, and the Claude add-ins for Google Docs, Google Sheets, and Google Slides) from your Claude Enterprise organizations to compliance reviewers. Each session is a single conversation with Claude; its transcript is the sequence of user prompts, assistant responses, and tool calls and results in that conversation. The endpoints support eDiscovery (electronic discovery) exports and data loss prevention (DLP) enforcement.

17The endpoints on this page expose transcripts of the sessions your users run in Claude apps and agents (today: Cowork, Claude Code, Claude Science, Claude for Microsoft 365, the Claude add-ins for Google Docs, Google Sheets, and Google Slides, and Claude in Chrome) from your Claude Enterprise organizations to compliance reviewers. Each session is a single conversation with Claude; its transcript is the sequence of user prompts, assistant responses, and tool calls and results in that conversation. The endpoints support eDiscovery (electronic discovery) exports and data loss prevention (DLP) enforcement.

1818

1919The Compliance API groups sessions into two endpoint families according to where they run: local session endpoints for sessions on users' machines, and remote session endpoints for sessions that run in the cloud in Anthropic-managed environments. Both families are read-only, and neither is available to Admin API keys (`sk-ant-admin01-...`): calls authenticated with an Admin API key return [403 Forbidden](https://platform.claude.com/docs/en/manage-claude/compliance-errors#403-forbidden).

2020

from line 26

2626| Claude Code in the terminal, in Claude Desktop, or in an IDE extension, running on the user's machine | Local session endpoints | `claude_code` |

2727| Claude Science desktop app, running on the user's machine | Local session endpoints | `claude_science` |

2828| Claude for Microsoft 365 (the Claude add-ins for Excel, PowerPoint, Word, and Outlook), running in the Microsoft 365 desktop or web apps | Local session endpoints | `office_agents/excel`, `office_agents/powerpoint`, `office_agents/word`, or `office_agents/outlook` |

29| Claude in Chrome (the browser extension's built-in chat), running on the user's machine | Local session endpoints | `claude_in_chrome` |

3029| The Claude add-ins for Google Docs, Google Sheets, and Google Slides, running in those Google apps | Local session endpoints | `office_agents/google_docs`, `office_agents/google_sheets`, or `office_agents/google_slides` |

30| Claude in Chrome (the browser extension's built-in chat), running on the user's machine | Local session endpoints | `claude_in_chrome` |

3131| Cowork sessions started on claude.ai web or mobile, running in the cloud in Anthropic-managed environments | Remote session endpoints (`/v1/compliance/apps/sessions/remote`) | `cowork_remote` |

3232

3333`office_agents` alone does not say which app the session came from, and it can come from Claude for Microsoft 365 or the Google add-ins. See the `product_surface` description under [Sessions on users' machines](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-local-sessions).

from line 58

5858

5959## Sessions on users' machines (local sessions)

6060

61Local sessions run on users' machines while they are signed in with their Claude Enterprise account: today, Cowork in Claude Desktop, Claude Code (in the terminal, in Claude Desktop, or in an IDE extension), the Claude Science desktop app, Claude for Microsoft 365 (in Excel, PowerPoint, Word, and Outlook), the Claude in Chrome browser extension, and the Claude add-ins for Google Docs, Google Sheets, and Google Slides.

61Local sessions run on users' machines while they are signed in with their Claude Enterprise account: today, Cowork in Claude Desktop, Claude Code (in the terminal, in Claude Desktop, or in an IDE extension), the Claude Science desktop app, Claude for Microsoft 365 (in Excel, PowerPoint, Word, and Outlook), the Claude add-ins for Google Docs, Google Sheets, and Google Slides, and the Claude in Chrome browser extension.

6262

6363The Compliance API exposes local sessions through three endpoints: `GET /v1/compliance/apps/sessions/local` lists session metadata, `GET /v1/compliance/apps/sessions/local/{session_id}` retrieves one session's metadata, and `GET /v1/compliance/apps/sessions/local/{session_id}/messages` returns one session's transcript. All three require the `read:compliance_user_data` scope and count only against the shared Compliance API rate limit; they are not subject to the second request budget that applies to the remote session endpoints. See [429 Too Many Requests](https://platform.claude.com/docs/en/manage-claude/compliance-errors#429-too-many-requests). If local sessions are not available to your parent organization, all three endpoints return 404 with the message `Local sessions are not available.` (see [Local session not found](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-session-not-found)); while session listings or captured content are temporarily unavailable, they return 503 (see [Local sessions temporarily unavailable](https://platform.claude.com/docs/en/manage-claude/compliance-errors#local-sessions-temporarily-unavailable)).

6464

from line 158

158158Project instruction files such as `CLAUDE.md` appear as ordinary user-role content. Skill content appears when the client sends it as message content and is not distinguished from other user text. For a coverage summary, see the [Compliance API FAQ](https://platform.claude.com/docs/en/manage-claude/compliance-faq#data-coverage-and-retention); for a table comparing local sessions with remote sessions and OpenTelemetry logging, see this page's introduction.

159159

160160```bash cURL

161session_id="clls_01HxKpLmNoPqRsTuVwXyZaBc"

162

163161curl --fail-with-body -sS \

164 "https://api.anthropic.com/v1/compliance/apps/sessions/local/$session_id/messages" \

162 "https://api.anthropic.com/v1/compliance/apps/sessions/local/clls_01HxKpLmNoPqRsTuVwXyZaBc/messages" \

165163 --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \

166164 --header "anthropic-version: 2023-06-01"

167165```

from line 375

377375The messages endpoint returns the session's transcript: user prompts, assistant responses, and tool calls and results. Thinking blocks and images are not included. For a coverage summary, see the [Compliance API FAQ](https://platform.claude.com/docs/en/manage-claude/compliance-faq#data-coverage-and-retention); for a table comparing remote sessions with local sessions and Cowork's OpenTelemetry logging, see this page's introduction.

378376

379377```bash cURL

380session_id="cse_01WpQrStUvXyZaBcDeFgHjK6"

381

382378curl --fail-with-body -sS \

383 "https://api.anthropic.com/v1/compliance/apps/sessions/remote/$session_id/messages" \

379 "https://api.anthropic.com/v1/compliance/apps/sessions/remote/cse_01WpQrStUvXyZaBcDeFgHjK6/messages" \

384380 --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \

385381 --header "anthropic-version: 2023-06-01"

386382```

manage-claude/inference-hooks Changed · +3 / -3 lines

from line 10

1010

1111Inference hooks let a Claude Enterprise organization route every governed prompt through an AI security server, an HTTPS service that the organization or its security vendor operates, before inference runs. When a user submits a prompt, Anthropic sends the conversation transcript to your AI security server and waits for an allow or deny verdict; a denied request never reaches the model. Security and compliance teams use Inference hooks to enforce data policies inline, and developers build the AI security server that evaluates each request.

1212

13Because the hook runs on Anthropic's servers, after the request leaves the client and before the model runs, it applies to every governed request uniformly, with nothing to install or deploy on user devices.

13Because the hook runs on Anthropic's servers, after the request leaves the client and before the model runs, it applies to every governed request uniformly, across all Claude products in your organization, with nothing to install or deploy on user devices.

1414

1515There are two hook events. `prompt` fires once per governed inference request, before inference begins. `tool_call` fires when Claude's response contains tool calls, before any of them runs, in organizations that have **Validate tool calls** on.

1616

from line 77

7777

7878Inference hooks are available to Claude Enterprise organizations. Configuring them requires the `organization:manage` permission, which only the Owner and Primary owner roles hold.

7979

80One hook governs conversations across claude.ai, Cowork, Claude Code, and Claude Tag sessions in your Claude Enterprise organization, whether they run on the web, in the desktop or mobile apps, in the CLI, or in Slack. Inference hooks are not available on Amazon Bedrock or Google Cloud.

80One hook governs conversations across all Claude products in your Claude Enterprise organization, including, but not limited to, claude.ai, Cowork, Claude Code, Claude for Microsoft 365, Claude Tag, and Claude in Chrome, whether they run on the web, in the desktop or mobile apps, in the CLI, or in Slack. Inference hooks are not available on Amazon Bedrock or Google Cloud.

8181

8282Governed requests are the inference requests behind the user's conversation. Ancillary requests aren't sent to your endpoint. These include conversation title generation and a measurement that Anthropic runs on Claude's reply after Claude Tag has posted it in Slack. System prompts and tool definitions are never included in what is sent. In voice mode, prompts and tool calls are sent to your endpoint too, though a small share of tool calls isn't, so don't rely on inference hooks as your only control for voice. If your endpoint denies a request in voice mode, the voice call usually ends with a general error message, and your deny reason isn't shown.

8383

from line 87

8787

8888* **Claude Security scans (beta).** [Claude Security](https://claude.com/product/claude-security) runs hosted scans on your connected repositories. A session a user opens to fix a finding, and the Claude Security plugin in Claude Code, are governed.

8989* **Code Review (research preview).** [Code Review](https://code.claude.com/docs/en/code-review) runs reviews on your GitHub pull requests. A review a user runs locally in Claude Code with `/code-review` is governed.

90* **Smart reports (beta).** Anthropic makes model calls to build your organization's [smart reports](https://support.claude.com/en/articles/16893491-get-started-with-smart-reports).

90* **Smart reports (beta).** Anthropic makes model calls to build your organization's [smart reports](https://support.claude.com/en/articles/16893491-get-started-with-smart-reports). What a user types or uploads when creating a report is governed.

9191

9292***

9393

manage-claude/plugins-api Changed · +8 / -8 lines

from line 26

2626

2727| Resource | Endpoints |

2828| ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

29| **Plugins**: list every plugin in the organization, upload a new one, look one up, choose the version members are served (roll back or promote), delete one | `GET /v1/organizations/plugins` `POST /v1/organizations/plugins` `GET /v1/organizations/plugins/{plugin_id}` `POST /v1/organizations/plugins/{plugin_id}` `DELETE /v1/organizations/plugins/{plugin_id}` |

30| **Plugin versions**: list a plugin's version history, upload a new version, look one up, download a version's files | `GET /v1/organizations/plugins/{plugin_id}/versions` `POST /v1/organizations/plugins/{plugin_id}/versions` `GET /v1/organizations/plugins/{plugin_id}/versions/{version}` `GET /v1/organizations/plugins/{plugin_id}/versions/{version}/content` |

31| **Installation settings**: read who can use an organization-owned plugin, set it for the whole organization or for one group, remove either setting | `GET /v1/organizations/plugins/{plugin_id}/installation_settings` `POST /v1/organizations/plugins/{plugin_id}/installation_settings/{target}` `DELETE /v1/organizations/plugins/{plugin_id}/installation_settings/{target}` |

32| **Shares**: read who a member has shared their own plugin with (read-only) | `GET /v1/organizations/plugins/{plugin_id}/shares` |

33| **Plugin marketplaces**: find a marketplace's ID, look one up, set the default installation setting for its plugins, check marketplace content before connecting it | `GET /v1/organizations/plugin_marketplaces` `GET /v1/organizations/plugin_marketplaces/{marketplace_id}` `POST /v1/organizations/plugin_marketplaces/{marketplace_id}` `POST /v1/organizations/plugin_marketplaces/validate_repository` `POST /v1/organizations/plugin_marketplaces/validate_archive` |

29| **Plugins:** list every plugin in the organization, upload a new one, look one up, choose the version members are served (roll back or promote), delete one | `GET /v1/organizations/plugins` `POST /v1/organizations/plugins` `GET /v1/organizations/plugins/{plugin_id}` `POST /v1/organizations/plugins/{plugin_id}` `DELETE /v1/organizations/plugins/{plugin_id}` |

30| **Plugin versions:** list a plugin's version history, upload a new version, look one up, download a version's files | `GET /v1/organizations/plugins/{plugin_id}/versions` `POST /v1/organizations/plugins/{plugin_id}/versions` `GET /v1/organizations/plugins/{plugin_id}/versions/{version}` `GET /v1/organizations/plugins/{plugin_id}/versions/{version}/content` |

31| **Installation settings:** read who can use an organization-owned plugin, set it for the whole organization or for one group, remove either setting | `GET /v1/organizations/plugins/{plugin_id}/installation_settings` `POST /v1/organizations/plugins/{plugin_id}/installation_settings/{target}` `DELETE /v1/organizations/plugins/{plugin_id}/installation_settings/{target}` |

32| **Shares:** read who a member has shared their own plugin with (read-only) | `GET /v1/organizations/plugins/{plugin_id}/shares` |

33| **Plugin marketplaces:** find a marketplace's ID, look one up, set the default installation setting for its plugins, check marketplace content before connecting it | `GET /v1/organizations/plugin_marketplaces` `GET /v1/organizations/plugin_marketplaces/{marketplace_id}` `POST /v1/organizations/plugin_marketplaces/{marketplace_id}` `POST /v1/organizations/plugin_marketplaces/validate_repository` `POST /v1/organizations/plugin_marketplaces/validate_archive` |

3434

3535This release does not include standalone skills (skills a member writes in the skills editor or uploads as a single skill in claude.ai). They do not appear in the inventory and cannot be created here. Plugins that Anthropic publishes are not inventoried either; their usage is reported by the [Analytics APIs](https://platform.claude.com/docs/en/manage-claude/analytics-api). Marketplaces are created, connected to repositories, and deleted in claude.ai, not through this API.

3636

from line 303

303303

304304While scanning is on, members are served a plugin only when its served version's scan is `completed` with `pass` or `warn`. While the scan runs, or after it fails, errors, or reaches no verdict, the plugin is withheld from members, and an earlier version is not served in its place. A version that was never scanned (`content_scan: null`) is served normally.

305305

306A version you upload through this API never waits for its content scan. When it becomes the served version, members lose the plugin until its scan passes, and stay without it if the scan fails. If members should keep the current version while a new one is scanned, pin the plugin first (see [Versions and the served version](https://platform.claude.com/docs/en/manage-claude/plugins-api#versions-and-the-served-version)).

306A version you upload through this API never waits for its content scan. When it becomes the served version, members lose the plugin until its scan completes with `pass` or `warn`. If members should keep the current version while a new one is scanned, pin the plugin first (see [Versions and the served version](https://platform.claude.com/docs/en/manage-claude/plugins-api#versions-and-the-served-version)).

307307

308308While a version saved in claude.ai waits for its scan, the served version does not change. When your API upload becomes the served version, any wait ends: the waiting version is served only if someone chooses it. To see a waiting version's scan, read the version (see [List a plugin's versions](https://platform.claude.com/docs/en/manage-claude/plugins-api#list-a-plugins-versions)).

309309

from line 1292

12921292

12931293| Status | Cause | What to do |

12941294| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |

1295| 400 | The body omits `served_version_id`, sets it to `null`, or contains any other field; or the value lacks the `pluginver_` prefix or is `latest`. | Send exactly `{"served_version_id": "pluginver_…"}`. |

1295| 400 | The body omits `served_version_id`, sets it to `null`, or contains any other field; or the value lacks the `pluginver_` prefix or is `latest`. | Send exactly `{"served_version_id": "pluginver_..."}`. |

12961296| 404 | `served_version_id` is not a version of this plugin. | Take the ID from [List a plugin's versions](https://platform.claude.com/docs/en/manage-claude/plugins-api#list-a-plugins-versions). |

12971297| 409 (no `error_code`) | An upload to this plugin or another served-version change is still in progress. | Retry shortly. |

12981298| 409 `skill_name_taken` | The plugin is in the library marketplace and the version has a skill whose name an organization skill now uses. | Choose another version, or rename one of the skills. |

from line 3222

32223222

32233223Changing a marketplace's default records one `marketplace_updated` event and no per-plugin events, even though it changes the value of every plugin that inherits the default. Reads are not recorded, except downloads of a member-owned plugin's archive. A write that changes nothing records nothing.

32243224

3225Shares given or withdrawn in claude.ai appear on the feed as `role_assignment_granted` and `role_assignment_revoked` events. This API does not report deletions: a deleted plugin is simply absent from the next list. A plugin removed by a Git synchronization, by deleting its marketplace (one `marketplace_deleted` event), or by deleting a member's account or the organization emits no per-plugin event, so re-list the full inventory periodically to catch removals.

3225Shares given or withdrawn in claude.ai appear on the feed as `role_assignment_granted` and `role_assignment_revoked` events. This API does not report deletions: a deleted plugin is absent from the next list. A plugin removed by a Git synchronization, by deleting its marketplace (one `marketplace_deleted` event), or by deleting a member's account or the organization emits no per-plugin event, so re-list the full inventory periodically to catch removals.

32263226

32273227## Customer-managed encryption keys

32283228

manage-claude/wif-providers/aws Changed · +29 / -30 lines

from line 110

110110 --duration-seconds 900 \

111111 --query WebIdentityToken --output text)

112112

113 RESPONSE=$(curl -sS https://api.anthropic.com/v1/oauth/token \

113 ACCESS_TOKEN=$(curl -sS https://api.anthropic.com/v1/oauth/token \

114114 -H "content-type: application/json" \

115 --data @- <<JSON

115 --data @- <<JSON | jq -r .access_token

116116 {

117117 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",

118118 "assertion": "$JWT",

from line 124

124124 JSON

125125 )

126126

127 ACCESS_TOKEN=$(echo "$RESPONSE" | jq -r .access_token)

128

129127 curl https://api.anthropic.com/v1/messages \

130128 -H "authorization: Bearer $ACCESS_TOKEN" \

131129 -H "anthropic-version: 2023-06-01" \

from line 132

134132 "model": "claude-opus-5-5",

135133 "max_tokens": 1024,

136134 "messages": [{"role": "user", "content": "Hello from AWS"}]

137 }' | jq -r '.content[] | select(.type == "text") | .text'

135 }'

138136 ```

139137

140138 ```python Python

from line 363

365363 ```

366364

367365 ```bash CLI

368 TOKEN_FILE=$(mktemp)

366 export ANTHROPIC_IDENTITY_TOKEN_FILE=$(mktemp)

369367 aws sts get-web-identity-token \

370368 --region us-east-1 \

371369 --audience "https://api.anthropic.com" \

372370 --signing-algorithm RS256 \

373371 --duration-seconds 900 \

374 --query WebIdentityToken --output text > "$TOKEN_FILE"

372 --query WebIdentityToken --output text > "$ANTHROPIC_IDENTITY_TOKEN_FILE"

375373

376 export ANTHROPIC_IDENTITY_TOKEN_FILE="$TOKEN_FILE"

377374 # ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID, and

378375 # ANTHROPIC_SERVICE_ACCOUNT_ID, and ANTHROPIC_WORKSPACE_ID are read from the environment

379376 ant messages create \

from line 466

469466

470467curl -sS https://api.anthropic.com/v1/oauth/token \

471468 -H "content-type: application/json" \

472 -d "{

473 \"grant_type\": \"urn:ietf:params:oauth:grant-type:jwt-bearer\",

474 \"assertion\": \"$JWT\",

475 \"federation_rule_id\": \"fdrl_...\",

476 \"organization_id\": \"00000000-0000-0000-0000-000000000000\",

477 \"service_account_id\": \"svac_...\",

478 \"workspace_id\": \"wrkspc_...\"

479 }" | jq

469 --data @- <<JSON

470{

471 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",

472 "assertion": "$JWT",

473 "federation_rule_id": "fdrl_...",

474 "organization_id": "00000000-0000-0000-0000-000000000000",

475 "service_account_id": "svac_...",

476 "workspace_id": "wrkspc_..."

477}

478JSON

480479```

481480

482481A successful exchange returns an `access_token` beginning with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange); the most common AWS-side cause is an `iss` mismatch (the per-account STS issuer URL must match the registered `issuer_url` exactly).

from line 616

617616 ```bash cURL

618617 JWT=$(cat "$ANTHROPIC_IDENTITY_TOKEN_FILE")

619618

620 RESPONSE=$(curl -sS https://api.anthropic.com/v1/oauth/token \

619 ACCESS_TOKEN=$(curl -sS https://api.anthropic.com/v1/oauth/token \

621620 -H "content-type: application/json" \

622 --data @- <<JSON

621 --data @- <<JSON | jq -r .access_token

623622 {

624623 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",

625624 "assertion": "$JWT",

from line 630

631630 JSON

632631 )

633632

634 ACCESS_TOKEN=$(echo "$RESPONSE" | jq -r .access_token)

635

636633 curl https://api.anthropic.com/v1/messages \

637634 -H "authorization: Bearer $ACCESS_TOKEN" \

638635 -H "anthropic-version: 2023-06-01" \

from line 638

641638 "model": "claude-opus-5-5",

642639 "max_tokens": 1024,

643640 "messages": [{"role": "user", "content": "Hello from EKS"}]

644 }' | jq -r '.content[] | select(.type == "text") | .text'

641 }'

645642 ```

646643

647644 ```python Python

from line 821

824821

825822curl -sS https://api.anthropic.com/v1/oauth/token \

826823 -H "content-type: application/json" \

827 -d "{

828 \"grant_type\": \"urn:ietf:params:oauth:grant-type:jwt-bearer\",

829 \"assertion\": \"$JWT\",

830 \"federation_rule_id\": \"$ANTHROPIC_FEDERATION_RULE_ID\",

831 \"organization_id\": \"$ANTHROPIC_ORGANIZATION_ID\",

832 \"service_account_id\": \"$ANTHROPIC_SERVICE_ACCOUNT_ID\",

833 \"workspace_id\": \"$ANTHROPIC_WORKSPACE_ID\"

834 }" | jq

824 --data @- <<JSON

825{

826 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",

827 "assertion": "$JWT",

828 "federation_rule_id": "$ANTHROPIC_FEDERATION_RULE_ID",

829 "organization_id": "$ANTHROPIC_ORGANIZATION_ID",

830 "service_account_id": "$ANTHROPIC_SERVICE_ACCOUNT_ID",

831 "workspace_id": "$ANTHROPIC_WORKSPACE_ID"

832}

833JSON

835834```

836835

837836A successful exchange returns an `access_token` beginning with `sk-ant-oat01-` and an `expires_in` value in seconds. If the exchange fails with the opaque `401` `authentication_error` response (message `Authentication failed`), check the [authentication history page](https://platform.claude.com/settings/workload-identity-federation?tab=history) in the Claude Console for the deny reason and see [Troubleshoot a failed exchange](https://platform.claude.com/docs/en/manage-claude/wif-reference#troubleshoot-a-failed-exchange); the most common EKS-side cause is the projected token's `aud` not matching the rule (project a token with `audience: https://api.anthropic.com`, not the IRSA default `sts.amazonaws.com`).

manage-claude/wif-providers/azure Changed · +5 / -7 lines

from line 182

182182 JSON

183183 )

184184

185 ACCESS_TOKEN=$(echo "$RESPONSE" | jq -r .access_token)

185 ACCESS_TOKEN=$(jq -r .access_token <<<"$RESPONSE")

186186

187187 # 3. Call the Claude API with the bearer token.

188188 curl https://api.anthropic.com/v1/messages \

from line 193

193193 "model": "claude-opus-5-5",

194194 "max_tokens": 1024,

195195 "messages": [{"role": "user", "content": "Hello from Azure"}]

196 }' | jq -r '.content[] | select(.type == "text") | .text'

196 }'

197197 ```

198198

199199 ```python Python

from line 597

597597 # Container Apps, fetch from "$IDENTITY_ENDPOINT?api-version=2019-08-01&resource=api://<APP_ID>"

598598 # with -H "X-IDENTITY-HEADER: $IDENTITY_HEADER" instead.

599599 # With multiple user-assigned identities, append &client_id=<IDENTITY_CLIENT_ID>.

600 ANTHROPIC_IDENTITY_TOKEN_FILE=$(mktemp)

600 export ANTHROPIC_IDENTITY_TOKEN_FILE=$(mktemp)

601601 trap 'rm -f "$ANTHROPIC_IDENTITY_TOKEN_FILE"' EXIT

602602 curl -sS -H "Metadata: true" \

603603 "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=api://<APP_ID>" \

604604 | jq -r .access_token > "$ANTHROPIC_IDENTITY_TOKEN_FILE"

605 export ANTHROPIC_IDENTITY_TOKEN_FILE

606605

607606 # ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID,

608607 # ANTHROPIC_SERVICE_ACCOUNT_ID, and ANTHROPIC_WORKSPACE_ID are read from the environment.

from line 833

834833 "model": "claude-opus-5-5",

835834 "max_tokens": 1024,

836835 "messages": [{"role": "user", "content": "Hello from Azure"}]

837 }' | jq -r '.content[] | select(.type == "text") | .text'

836 }'

838837 ```

839838

840839 ```python Python

from line 1219

12201219 ```bash CLI

12211220 # 1. Exchange the Kubernetes-projected token for an Entra-issued access

12221221 # token and write it to a temp file the CLI can read.

1223 ANTHROPIC_IDENTITY_TOKEN_FILE=$(mktemp)

1222 export ANTHROPIC_IDENTITY_TOKEN_FILE=$(mktemp)

12241223 trap 'rm -f "$ANTHROPIC_IDENTITY_TOKEN_FILE"' EXIT

12251224 curl -sS "https://login.microsoftonline.com/$AZURE_TENANT_ID/oauth2/v2.0/token" \

12261225 -d client_id="$AZURE_CLIENT_ID" \

from line 1228

12291228 -d client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer \

12301229 --data-urlencode client_assertion@"$AZURE_FEDERATED_TOKEN_FILE" \

12311230 | jq -r .access_token > "$ANTHROPIC_IDENTITY_TOKEN_FILE"

1232 export ANTHROPIC_IDENTITY_TOKEN_FILE

12331231

12341232 # 2. Call the Claude API. ANTHROPIC_FEDERATION_RULE_ID,

12351233 # ANTHROPIC_ORGANIZATION_ID, ANTHROPIC_SERVICE_ACCOUNT_ID, and ANTHROPIC_WORKSPACE_ID are read

manage-claude/wif-providers/gcp Changed · +3 / -4 lines

from line 148

148148 }

149149 JSON

150150 )

151 ACCESS_TOKEN=$(echo "$RESPONSE" | jq -r .access_token)

151 ACCESS_TOKEN=$(jq -r .access_token <<<"$RESPONSE")

152152

153153 # Call the Claude API

154154 curl -sS https://api.anthropic.com/v1/messages \

from line 159

159159 "model": "claude-opus-5-5",

160160 "max_tokens": 1024,

161161 "messages": [{"role": "user", "content": "Hello from Cloud Run"}]

162 }' | jq -r '.content[] | select(.type == "text") | .text'

162 }'

163163 ```

164164

165165 ```python Python

from line 375

375375

376376 ```bash CLI

377377 # Write the Google-signed identity token to a file the CLI can read

378 ANTHROPIC_IDENTITY_TOKEN_FILE=$(mktemp)

378 export ANTHROPIC_IDENTITY_TOKEN_FILE=$(mktemp)

379379 curl -sS -H "Metadata-Flavor: Google" \

380380 "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=https://api.anthropic.com&format=full" \

381381 > "$ANTHROPIC_IDENTITY_TOKEN_FILE"

382 export ANTHROPIC_IDENTITY_TOKEN_FILE

383382

384383 # ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID, and

385384 # ANTHROPIC_SERVICE_ACCOUNT_ID, and ANTHROPIC_WORKSPACE_ID are read from the environment.

manage-claude/wif-providers/github-actions Changed · +3 / -5 lines

from line 145

145145 ```bash cURL

146146 JWT=$(cat /tmp/gha-jwt)

147147

148 RESPONSE=$(curl -sS https://api.anthropic.com/v1/oauth/token \

148 ACCESS_TOKEN=$(curl -sS https://api.anthropic.com/v1/oauth/token \

149149 -H "content-type: application/json" \

150 --data @- <<JSON

150 --data @- <<JSON | jq -r .access_token

151151 {

152152 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",

153153 "assertion": "$JWT",

from line 159

159159 JSON

160160 )

161161

162 ACCESS_TOKEN=$(echo "$RESPONSE" | jq -r .access_token)

163

164162 curl https://api.anthropic.com/v1/messages \

165163 -H "authorization: Bearer $ACCESS_TOKEN" \

166164 -H "anthropic-version: 2023-06-01" \

from line 167

169167 "model": "claude-opus-5-5",

170168 "max_tokens": 1024,

171169 "messages": [{"role": "user", "content": "Hello, Claude"}]

172 }' | jq -r '.content[] | select(.type == "text") | .text'

170 }'

173171 ```

174172

175173 ```python Python

manage-claude/wif-providers/okta Changed · +6 / -4 lines

from line 106

106106 -H "authorization: Bearer $ACCESS_TOKEN" \

107107 -H "anthropic-version: 2023-06-01" \

108108 -H "content-type: application/json" \

109 -d '{"model": "claude-opus-5-5", "max_tokens": 1024, "messages": [{"role": "user", "content": "Hello, Claude"}]}' \

110 | jq -r '.content[] | select(.type == "text") | .text'

109 -d '{

110 "model": "claude-opus-5-5",

111 "max_tokens": 1024,

112 "messages": [{"role": "user", "content": "Hello, Claude"}]

113 }'

111114 ```

112115

113116 ```python Python

from line 390

387390

388391 ```bash CLI

389392 # 1. Request an access token from Okta and write it to a temp file.

390 ANTHROPIC_IDENTITY_TOKEN_FILE=$(mktemp)

393 export ANTHROPIC_IDENTITY_TOKEN_FILE=$(mktemp)

391394 curl -sS "$OKTA_ISSUER/v1/token" \

392395 -d grant_type=client_credentials \

393396 -d scope=anthropic.access \

from line 397

394397 -d client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer \

395398 --data-urlencode client_assertion="$SIGNED_CLIENT_ASSERTION" \

396399 | jq -r .access_token > "$ANTHROPIC_IDENTITY_TOKEN_FILE"

397 export ANTHROPIC_IDENTITY_TOKEN_FILE

398400

399401 # 2. Call the Claude API. The CLI reads ANTHROPIC_FEDERATION_RULE_ID,

400402 # ANTHROPIC_ORGANIZATION_ID, ANTHROPIC_SERVICE_ACCOUNT_ID, ANTHROPIC_WORKSPACE_ID, and

manage-claude/workload-identity-federation Changed · +2 / -4 lines

from line 95

9595 JWT=$(cat /var/run/secrets/anthropic.com/token)

9696

9797 # 2. Exchange it for a short-lived Anthropic access token.

98 RESPONSE=$(curl -sS https://api.anthropic.com/v1/oauth/token \

98 ACCESS_TOKEN=$(curl -sS https://api.anthropic.com/v1/oauth/token \

9999 -H "content-type: application/json" \

100 -d @- <<JSON

100 -d @- <<JSON | jq -r .access_token

101101 {

102102 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",

103103 "assertion": "$JWT",

from line 108

108108 }

109109 JSON

110110 )

111

112 ACCESS_TOKEN=$(jq -r .access_token <<<"$RESPONSE")

113111 # The response's expires_in is the token's lifetime in seconds; re-exchange before it elapses.

114112

115113 # 3. Call the API with the access token in the Authorization: Bearer header.

One read of Claude Developer Platformapi-20261019T193710Z

What this read moved

build-with-claude/skills-guide Changed · +47 / -272 lines

build-with-claude/streaming Changed · +2 / -3 lines

build-with-claude/structured-outputs Changed · +23 / -25 lines

build-with-claude/thinking Changed · +2 / -4 lines

build-with-claude/thinking-tool-workflows Changed · +6 / -64 lines

build-with-claude/token-counting Changed · +3 / -6 lines

build-with-claude/vision Changed · +9 / -11 lines

build-with-claude/working-with-messages Changed · +5 / -9 lines

claude_api_primer Changed · +8 / -71 lines

cli-sdks-libraries/cli/using Changed · +1 / -8 lines

manage-claude/admin-api Changed · +20 / -22 lines

manage-claude/admin-api-keys Changed · +9 / -5 lines

manage-claude/compliance-activity-feed Changed · +5 / -5 lines

manage-claude/compliance-content-data Changed · +4 / -12 lines

manage-claude/compliance-integration-patterns Changed · +2 / -3 lines

manage-claude/compliance-org-data Changed · +5 / -15 lines

manage-claude/compliance-sessions Changed · +6 / -10 lines

manage-claude/inference-hooks Changed · +3 / -3 lines

manage-claude/plugins-api Changed · +8 / -8 lines

manage-claude/wif-providers/aws Changed · +29 / -30 lines

manage-claude/wif-providers/azure Changed · +5 / -7 lines

manage-claude/wif-providers/gcp Changed · +3 / -4 lines

manage-claude/wif-providers/github-actions Changed · +3 / -5 lines

manage-claude/wif-providers/okta Changed · +6 / -4 lines

manage-claude/workload-identity-federation Changed · +2 / -4 lines