One read of Claude Developer Platformapi-20261021T193714Z
242 pages moved out of 808 read.
Pages moved
242
significant first
Pages read
808
in this capture
Captured
19:37 UTC
Corpus hash
851c97e9b6f0
corpus-hash
What this read moved
201-225 of 242, page 9 of 10This capture is too large to show at once. Changes 201-225 of 242 are below, significant first; the rest are on the following screens.
about-claude/additional-resources Changed · +1 / -1 lines
from line 15
1515 Step-by-step lessons on building with Claude.
1616 </Card>
1717
18 <Card title="Cookbook" icon="fork-knife" href="https://platform.claude.com/cookbook">
18 <Card title="Claude Cookbook" icon="fork-knife" href="https://platform.claude.com/cookbook">
1919 Replicable code samples and implementations.
2020 </Card>
2121
agents-and-tools/agent-skills/quickstart Changed · +1 / -1 lines
from line 27
2727
2828## Step 1: List available Skills
2929
30First, check what Skills are available. Use the Skills API to list all Anthropic-managed Skills. Each language tab is an excerpt from one continuous script, with any imports and client setup at the top:
30First, check what Skills are available. Use the Skills API to list all Anthropic-managed Skills. The example is an excerpt from one continuous script, with any imports and client setup at the top:
3131
3232<CodeGroup>
3333 ```bash cURL
agents-and-tools/mcp-tunnels/security Changed · +1 / -1 lines
from line 12
1212
1313## Best practices
1414
15* **Require OAuth on every MCP server.** Configure each [upstream MCP server](https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/concepts#components) to require OAuth as described in the [MCP authorization spec](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization). OAuth provides defense in depth on top of the tunnel's transport authentication and enables user-level authorization at the data layer.
15* **Require OAuth on every MCP server.** Configure each [upstream MCP server](https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/concepts#components) to require OAuth as described in the [MCP authorization spec](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization). OAuth provides defense in depth on top of the tunnel's transport authentication and allows user-level authorization at the data layer.
1616* **Enable SSO for your organization.** Tunnels, federation rules, and service accounts are managed in the Claude Console. SSO enforces your identity provider's session controls on the admins who can change them.
1717* **Restrict `upstream.allowed_ips`.** Use the smallest CIDR ranges that cover your MCP servers. This is the [proxy](https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/concepts#components)'s primary SSRF defense.
1818* **Monitor logs.** Alert on warnings, errors, and unusual traffic patterns from the tunnel stack.
agents-and-tools/remote-mcp-servers Changed · +1 / -1 lines
from line 7
77Several companies have deployed remote MCP servers that developers can connect to by using the Anthropic MCP connector API. These servers expand the capabilities available to developers and end users by providing remote access to various services and tools through the MCP protocol.
88
99<Note>
10 The remote MCP servers listed below are third-party services designed to work with the Claude API. These servers are not owned, operated, or endorsed by Anthropic. Users should only connect to remote MCP servers they trust and should review each server's security practices and terms before connecting.
10 The remote MCP servers listed later on this page are third-party services designed to work with the Claude API. These servers are not owned, operated, or endorsed by Anthropic. Users should only connect to remote MCP servers they trust and should review each server's security practices and terms before connecting.
1111</Note>
1212
1313## Connecting to remote MCP servers
agents-and-tools/tool-use/strict-tool-use Changed · +2 / -2 lines
from line 6
66
77Setting `strict: true` on a tool definition guarantees Claude's tool inputs match your JSON Schema by constraining the model's token sampling to schema-valid outputs (a technique called grammar-constrained sampling). This page covers why strict mode matters for agents, how to enable it, and common use cases. For the supported JSON Schema subset, see [JSON Schema limitations](https://platform.claude.com/docs/en/build-with-claude/structured-outputs#json-schema-limitations). For non-strict schema guidance, see [Define tools](https://platform.claude.com/docs/en/agents-and-tools/tool-use/define-tools).
88
9Strict tool use validates tool parameters, ensuring Claude calls your functions with correctly-typed arguments. Use strict tool use when you need to:
9Strict tool use validates tool parameters, ensuring Claude calls your functions with correctly typed arguments. Use strict tool use when you need to:
1010
1111* Validate tool parameters
1212* Build agentic workflows
from line 19
1919
2020Strict tool use guarantees type-safe parameters:
2121
22* Functions receive correctly-typed arguments every time
22* Functions receive correctly typed arguments every time
2323* No need to validate and retry tool calls
2424* Production-ready agents that work consistently at scale
2525
agents-and-tools/tool-use/tool-use-with-prompt-caching Changed · +2 / -2 lines
from line 42
4242
4343For `mcp_toolset`, the `cache_control` breakpoint lands on the last tool in the set. You don't control tool order within an MCP toolset, so place the breakpoint on the `mcp_toolset` entry itself and the API applies it to the final expanded tool.
4444
45The [computer use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool) and [browser use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool) toolset entries follow the same rule: place `cache_control` on the toolset entry itself, and the breakpoint lands after the toolset's definition. It isn't accepted inside a member's `configs` entry, because the toolset's members load as one definition. Within a [batch action](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool#batch-actions), a `cache_control` marker on any of the turn's member `tool_use` or `tool_result` blocks is accepted and takes effect at the end of that batch, so several markers in one batch act as a single breakpoint. Each marker still counts toward the request's limit of [four breakpoints](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#when-to-use-multiple-breakpoints), so use one per turn.
45The [computer use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool) and [browser use](https://platform.claude.com/docs/en/agents-and-tools/tool-use/browser-use-tool) toolset entries follow the same rule: place `cache_control` on the toolset entry itself, and the breakpoint lands after the toolset's definition. It isn't accepted inside a member's `configs` entry, because the toolset's members load as one definition. Within a [batch action](https://platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool#batch-actions), a `cache_control` marker on any of the turn's member `tool_use` or `tool_result` blocks is accepted and takes effect at the end of that batch, so several markers in one batch act as a single breakpoint. Each marker still counts toward the request's limit of [four breakpoints](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#when-to-use-multiple-breakpoints), so use one for each turn.
4646
4747## defer\_loading and cache preservation
4848
from line 74
7474
7575When your request has prompt caching enabled and Claude uses a [server tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/server-tools) such as web search, web fetch, or code execution, the API automatically places a cache breakpoint on the server tool result before running the next iteration of the agentic loop. This lets later iterations within the same request read the growing prefix from cache instead of reprocessing it.
7676
77This automatic breakpoint always uses the default 5-minute TTL, independent of any TTL you set on your own `cache_control` markers. In the response `usage`, these writes appear under `cache_creation.ephemeral_5m_input_tokens`, so you may see 5-minute cache writes even when every `cache_control` you set uses a 1-hour TTL.
77This automatic breakpoint always uses the default 5-minute TTL, independent of any TTL you set on your own `cache_control` markers. In the response `usage`, these writes appear under `cache_creation.ephemeral_5m_input_tokens`, so you might see 5-minute cache writes even when every `cache_control` you set uses a 1-hour TTL.
7878
7979This behavior only applies when your request already has at least one `cache_control` marker. Requests without prompt caching do not receive the automatic breakpoint.
8080
api/ip-addresses Changed · +2 / -2 lines
from line 1
11---
22title: IP addresses
33url: https://platform.claude.com/docs/en/api/ip-addresses
4description: Anthropic services use fixed IP addresses for both inbound and outbound connections. You can use these addresses to configure your firewall rules for secure access to the Claude API and Console. These addresses will not change without notice.
4description: Anthropic services use fixed IP addresses for both inbound and outbound connections. You can use these addresses to configure your firewall rules for secure access to the Claude API and Claude Console. These addresses will not change without notice.
55---
66
77<Note>
from line 30
3030
3131### Phased out IP addresses
3232
33The following IP addresses are no longer in use by Anthropic. If you have previously allowlisted these addresses, you should remove them from your firewall rules.
33The following IP addresses are no longer in use by Anthropic. If you have previously allowlisted these addresses, remove them from your firewall rules.
3434
3535```text wrap
363634.162.46.92/32
api/supported-regions Changed · +1 / -1 lines
from line 1
11---
22title: Supported regions
33url: https://platform.claude.com/docs/en/api/supported-regions
4description: "Here are the countries, regions, and territories we can currently support access from:"
4description: "Here are the countries, regions, and territories Anthropic can support access from:"
55---
66
77* Albania
build-with-claude/compaction-thinking-blocks Changed · +2 / -2 lines
from line 51
5151
5252## Change the system prompt or tools
5353
54A later request can use a different `system`, different `tools`, or a different model than the compaction request, and the API still accepts the block. Such a change can invalidate the thinking in the kept turns, but it has no other effect.
54A later request can use a different `system`, different `tools`, or a different model from the compaction request, and the API still accepts the block. Such a change can invalidate the thinking in the kept turns, but it has no other effect.
5555
5656To change `system` or `tools` without invalidating any kept thinking, compact the whole conversation first, so no turns are kept. Then change them on the next request.
5757
from line 68
68683. Send the next request, with the block first, then the kept turn, then a new `user` message, and with `thinking.block_binding.prefix_mismatch_behavior` set to `"error"`.
69694. Read the result. A 200 response whose `input_transformations` array is empty means no thinking block failed the check or was dropped. A 400 error that says the block is bound to a different conversation means one did. The message starts with the path of the first block that failed, and [What the API does with an invalid block](https://platform.claude.com/docs/en/build-with-claude/preserved-thinking#mismatch-behavior) shows it in full.
7070
71The `prefix_mismatch_behavior` field needs the `thinking-binding-controls-2026-08-01` beta header in addition to [the `compact-2026-09-04` beta header](https://platform.claude.com/docs/en/build-with-claude/compaction-on-demand#request-a-summary). Setting the field also opts the request into the check on accounts where the check isn't on by default.
71The `prefix_mismatch_behavior` field needs the `thinking-binding-controls-2026-08-01` beta header in addition to the [`compact-2026-09-04` beta header](https://platform.claude.com/docs/en/build-with-claude/compaction-on-demand#request-a-summary). Setting the field also opts the request into the check on accounts where the check isn't on by default.
7272
7373The following program runs the four steps. It prints how many thinking blocks the kept turn holds and how many entries `input_transformations` has; no entries means the kept thinking held:
7474
build-with-claude/context-windows Changed · +2 / -2 lines
from line 54
5454The following diagram shows how tokens are managed when thinking is enabled on a model that strips previous thinking blocks:
5555
5656<Frame>
57 
57 
5858</Frame>
5959
6060* **Stripping thinking blocks:** On models that strip previous thinking blocks, thinking blocks (shown in dark gray) are generated during each turn's output phase but are not carried forward as input tokens for subsequent turns. You do not need to strip the thinking blocks yourself: if you pass them back, the Claude API strips them automatically.
from line 69
6969The following diagram illustrates how tokens are managed when you combine thinking with tool use on a model that strips previous thinking blocks:
7070
7171<Frame>
72 
72 
7373</Frame>
7474
7575<Steps>
build-with-claude/multilingual-support Changed · +1 / -1 lines
from line 181
181181
182182When working with multilingual content:
183183
1841. **Provide clear language context:** Although Claude can detect the target language automatically, explicitly stating the desired input and output languages improves reliability. For enhanced fluency, you can prompt Claude to use "idiomatic speech as if it were a native speaker."
1841. **Provide clear language context:** Although Claude can detect the target language automatically, explicitly stating the input and output languages you want improves reliability. For enhanced fluency, you can prompt Claude to use "idiomatic speech as if it were a native speaker."
1851852. **Use native scripts:** Submit text in its native script rather than transliteration for optimal results.
1861863. **Consider cultural context:** Effective communication often requires cultural and regional awareness beyond pure translation.
187187
build-with-claude/prompt-engineering/overview Changed · +2 / -2 lines
from line 12
12122. Some ways to empirically test against those criteria
13133. A first draft prompt you want to improve
1414
15If not, spend time establishing that first. Check out [Define success criteria and build evaluations](https://platform.claude.com/docs/en/test-and-evaluate/develop-tests) for tips and guidance.
15If not, spend time establishing that first. See [Define success criteria and build evaluations](https://platform.claude.com/docs/en/test-and-evaluate/develop-tests) for tips and guidance.
1616
1717<CardGroup cols={2}>
1818 <Card title="Prompt generator notebook" icon="link" href="https://colab.research.google.com/github/anthropics/claude-cookbooks/blob/main/misc/metaprompt.ipynb">
from line 28
2828
2929## When to prompt engineer
3030
31This guide focuses on success criteria that are controllable through prompt engineering. Not every success criteria or failing eval is best solved by prompt engineering. For example, you can sometimes improve latency and cost more easily by selecting a different model.
31This guide focuses on success criteria that are controllable through prompt engineering. Not every success criterion or failing eval is best solved by prompt engineering. For example, you can sometimes improve latency and cost more easily by choosing a different model.
3232
3333***
3434
cli-sdks-libraries/cli/apply Changed · +1 / -1 lines
from line 93
9393}
9494```
9595
96Commit it with your files. It's how the next run, on your machine or in CI, finds these resources instead of creating them again, and it's where you read an agent's ID to [start a session](https://platform.claude.com/docs/en/managed-agents/sessions). The two hashes fingerprint what was last sent and what the API returned. That's how a later run notices an edited file, or a resource changed outside these files.
96Commit it with your files. It's how the next run, on your machine or in CI, finds these resources instead of creating them again, and it's where you read an agent's ID to [start a session](https://platform.claude.com/docs/en/managed-agents/sessions). The two hashes fingerprint what was last sent and what the API returned. That's how a later run detects an edited file, or a resource changed outside these files.
9797
9898## Grow it into a project
9999
cli-sdks-libraries/cli/quickstart Changed · +1 / -1 lines
from line 153
153153 </Card>
154154
155155 <Card title="CLI scripting and automation" icon="code" href="https://platform.claude.com/docs/en/cli-sdks-libraries/cli/scripting">
156 Version-control API resources, scripting patterns, and use from Claude Code
156 Version control for API resources, scripting patterns, and use from Claude Code
157157 </Card>
158158</CardGroup>
159159
cli-sdks-libraries/cli/scripting Changed · +2 / -2 lines
from line 72
7272
7373### Chain list output into a second command
7474
75`--transform id --raw-output` on a list endpoint emits one bare ID per line, so standard tools such as `head` and `xargs` apply directly. Capture the first result, then pass it to a follow-up command:
75`--transform id --raw-output` on a list endpoint emits one bare ID on each line, so standard tools such as `head` and `xargs` apply directly. Capture the first result, then pass it to a follow-up command:
7676
7777```bash
7878FIRST_AGENT=$(ant beta:agents list --transform id --raw-output | head -1)
from line 104
104104* "Upload every PDF in `./reports` to the Files API and print the resulting IDs."
105105* "Pull the events for session `session_01...` and tell me where the agent got stuck."
106106
107Claude Code shells out to `ant`, parses the structured output, and reasons over the results (no custom integration code required).
107Claude Code runs `ant` commands, parses the structured output, and reasons over the results (no custom integration code required).
108108
109109## Authenticate curl requests with CLI credentials
110110
cli-sdks-libraries/cli/sessions-connect Changed · +2 / -2 lines
from line 32
3232| Page Up, Page Down | Scroll through the transcript. Scrolling up pauses following; End resumes it. |
3333| Ctrl+C | Detach. Ctrl+D on an empty input line also detaches. |
3434
35When a tool call is waiting for your approval, the input line changes to **Allow tool call?** This happens under an `always_ask` policy, or under `auto` when the server reaches no determination. Choose **Yes**, **No**, or **No, and tell the agent why**. The CLI sends your choice as a [`user.tool_confirmation`](https://platform.claude.com/docs/en/managed-agents/permission-policies#respond-to-confirmation-requests) event, with any reason you type as its `deny_message`.
35When a tool call is waiting for your approval, the input line changes to **Allow tool call?** This occurs under an `always_ask` policy, or under `auto` when the server reaches no determination. Select **Yes**, **No**, or **No, and tell the agent why**. The CLI sends your choice as a [`user.tool_confirmation`](https://platform.claude.com/docs/en/managed-agents/permission-policies#respond-to-confirmation-requests) event, with any reason you type as its `deny_message`.
3636
3737If the session is `terminated` or deleted, the view is read-only.
3838
from line 44
4444
4545`--web` serves the Console's session viewer from a local server on `127.0.0.1`, prints its URL, and opens it in your browser. Add `--no-browser` to skip opening the browser. You can also send messages, interrupt the agent, and allow or deny a tool call from the browser. Unlike the terminal view, the browser viewer follows every thread of a multiagent session.
4646
47The URL can be opened once, within two minutes of being printed. Reloading that tab works, but to open the viewer anywhere else, run the command again. Your credentials never leave the CLI: the page sends requests only to the local `ant` process, which makes the API requests. The server runs until you press Ctrl+C.
47The URL can be opened once, within 2 minutes of being printed. Reloading that tab works, but to open the viewer anywhere else, run the command again. Your credentials never leave the CLI: the page sends requests only to the local `ant` process, which makes the API requests. The server runs until you press Ctrl+C.
4848
cli-sdks-libraries/middleware Changed · +1 / -1 lines
from line 173
173173
174174## Replacing the HTTP client
175175
176The SDK also accepts a custom HTTP client (for proxy configuration, custom TLS, or connection pooling). Only one HTTP client is used per SDK client; setting it replaces the default. The custom HTTP client receives requests after all middleware has run.
176The SDK also accepts a custom HTTP client (for proxy configuration, custom TLS, or connection pooling). Only one HTTP client is used for each SDK client; setting it replaces the default. The custom HTTP client receives requests after all middleware has run.
177177
178178## Built-in middleware
179179
get-started Changed · +1 / -1 lines
from line 15
1515 <Tab title="cURL">
1616 <Steps>
1717 <Step title="Set your API key">
18 Export your API key as an environment variable. The cURL command below reads it from `$ANTHROPIC_API_KEY`.
18 Export your API key as an environment variable. The cURL command in the following step reads it from `$ANTHROPIC_API_KEY`.
1919
2020 ```bash
2121 export ANTHROPIC_API_KEY="your-api-key-here"
manage-claude/app-attest Changed · +1 / -1 lines
from line 16
1616
1717The first time your app uses Claude on a device, the app requests a challenge from Anthropic, attests the device with Apple's `DCAppAttestService`, and exchanges the verified attestation for an access token. The Claude for Foundation Models package runs this flow automatically and requests new tokens as they expire; there is no attestation code for you to write.
1818
19Tokens are scoped to your workspace, expire after one hour, and authorize only [Messages API](https://platform.claude.com/docs/en/api/messages/create) calls. They carry no end-user identity: App Attest identifies your app, not the person using it, so handle any per-user logic in your app.
19Tokens are scoped to your workspace, expire after 1 hour, and authorize only [Messages API](https://platform.claude.com/docs/en/api/messages/create) calls. They carry no end-user identity: App Attest identifies your app, not the person using it, so handle any per-user logic in your app.
2020
2121## Set up App Attest
2222
manage-claude/compliance-api-access Changed · +1 / -1 lines
from line 41
4141 <Step title="Enable the Compliance API">
4242 Where you enable the Compliance API depends on how your organization is set up:
4343
44 * **Claude Enterprise organizations:** The primary owner enables the Compliance API at [claude.ai > Organization settings > API](https://claude.ai/admin-settings/api-access). Enablement happens at the parent organization level and cascades to every linked organization, both claude.ai and Claude Console.
44 * **Claude Enterprise organizations:** The primary owner enables the Compliance API at [claude.ai > Organization settings > API](https://claude.ai/admin-settings/api-access). Enablement occurs at the parent organization level and cascades to every linked organization, both claude.ai and Claude Console.
4545 * **Standalone Claude Console organizations:** An organization admin turns on the **Compliance API** toggle on the [Compliance](https://platform.claude.com/settings/security) page (`platform.claude.com/settings/security`) in the Claude Console. Enablement is self-service for eligible organizations, and the change takes effect immediately. If the page shows a page-not-found error, or doesn't show the **Compliance API** section, you do not have the admin role, your organization is linked to a parent organization (the Compliance API is enabled from the parent organization instead), or your organization is not eligible for self-service enablement; contact your account team or [Anthropic support](https://support.claude.com) if you are not sure which applies.
4646 * **Claude Console organizations linked to a parent organization:** There is nothing to turn on in Claude Console. Ask the primary owner of your parent organization to enable the Compliance API in claude.ai, or contact your account team.
4747
manage-claude/compliance-errors Changed · +2 / -2 lines
from line 25
2525
2626Match on the HTTP status code and `error.type`, not on the message string. Messages are stable enough to copy into runbooks but might be reworded over time; the status codes and type values are part of the API contract. A few responses that share a status code and type are told apart by an error code in `error.details.error_code` when the response carries one, and otherwise by their message; each is called out where it applies.
2727
28The following table tells you at a glance whether to retry. Each section that follows shows the verbatim error body and the fix.
28The following table tells you whether to retry. Each section that follows shows the verbatim error body and the fix.
2929
3030| Status | Retry? | When |
3131| -------------------------------------------------------------------------------------------------------------------------- | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
from line 469
469469
470470A 500 from the Compliance API carries an `x-should-retry: false` response header when the failure is deterministic. The Claude SDK honors this header automatically. If you use a generic HTTP retry library that retries on every 5xx, suppress retries when `x-should-retry` is `false`; retrying this error fails identically on every attempt.
471471
472A 500 without the `x-should-retry: false` header is transient: retry with exponential backoff (start at 1 second, double up to 60 seconds). The same applies to 502, 503, 504, and 529 responses. The exception is a small set of local session 503s, described next, that depend on an organization's settings or encryption key rather than on load. See [Errors](https://platform.claude.com/docs/en/api/errors) for the platform-wide retry semantics.
472A 500 without the `x-should-retry: false` header is transient: retry with exponential backoff (start at 1 second, double up to 60 seconds). The same applies to 502, 503, 504, and 529 responses. The exception is a small set of local session 503s, described next, that depend on an organization's settings or encryption key rather than on load. See [Claude API errors](https://platform.claude.com/docs/en/api/errors) for the platform-wide retry semantics.
473473
474474### Local sessions temporarily unavailable
475475
manage-claude/compliance-org-data Changed · +1 / -1 lines
from line 287
287287
288288Each row carries `name`, `type`, and `value`; the `type` field (`boolean`, `integer`, `string_list`, `provisioning_mode`, or `data_retention`) tells you the shape of `value`. The full list of setting names, and the `value` schema for each type, is in [Get effective organization settings](https://platform.claude.com/docs/en/api/compliance/organizations/settings/retrieve) in the API reference.
289289
290The `api_keys` array lists every Compliance Access Key configured for your parent organization, so the same list is returned regardless of which linked organization you query. Each entry carries the key's `type` (`compliance_api_key`), `id`, `name`, `scopes`, `is_active` flag, `created_at` and `expires_at` timestamps, and `created_by_id` (the ID of the user who created the key; may be `null`). The key's secret value is never returned. Deactivated keys are included with `is_active: false` so you can review keys that previously had access, and keys that carry only the retired `read:compliance_org_settings` scope remain in the list for audit and cleanup visibility even though that scope no longer grants access.
290The `api_keys` array lists every Compliance Access Key configured for your parent organization, so the same list is returned regardless of which linked organization you query. Each entry carries the key's `type` (`compliance_api_key`), `id`, `name`, `scopes`, `is_active` flag, `created_at` and `expires_at` timestamps, and `created_by_id` (the ID of the user who created the key; might be `null`). The key's secret value is never returned. Deactivated keys are included with `is_active: false` so you can review keys that previously had access, and keys that carry only the retired `read:compliance_org_settings` scope remain in the list for audit and cleanup visibility even though that scope no longer grants access.
291291
292292The top-level `organization_id` is the organization's bare UUID: the same value as `uuid` in the organizations list, not the `org_`-prefixed form that `organization_id` carries on Activity Feed, chat, and project records (see the [organization identifier table](https://platform.claude.com/docs/en/manage-claude/compliance-org-data#list-organizations)).
293293
manage-claude/wif-providers/kubernetes Changed · +2 / -2 lines
from line 132
132132
133133 ACCESS_TOKEN=$(curl -sS https://api.anthropic.com/v1/oauth/token \
134134 -H "content-type: application/json" \
135 --data @- <<JSON | jq -r .access_token
135 -d @- <<JSON | jq -r .access_token
136136 {
137137 "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
138138 "assertion": "$JWT",
from line 303
303303
304304* **Pin namespace and service-account name:** Use the full `system:serviceaccount:<namespace>:<name>` value with no trailing `*`.
305305* **Always set an audience:** Require `audience` on the rule and set the same value on the pod's `serviceAccountToken` projection so default-audience tokens are rejected.
306* **Use a separate rule per namespace:** Create a distinct rule and Anthropic service account for each namespace rather than widening one rule.
306* **Use a separate rule for each namespace:** Create a distinct rule and Anthropic service account for each namespace rather than widening one rule.
307307* **Scope inline-JWKS issuers to one cluster:** When several clusters share an issuer URL, register each cluster's JWKS as its own federation issuer and bind rules to that issuer only.
308308
309309## Next steps
managed-agents/agent-setup Changed · +2 / -2 lines
from line 34
3434
3535The following example defines a coding agent that uses the newest Claude Opus model with access to the pre-built agent toolset. The toolset lets the agent write code, read files, search the web, and more. See the [agent tools reference](https://platform.claude.com/docs/en/managed-agents/tools) for the full list of supported tools.
3636
37The examples use curl, the `ant` CLI, or one of the SDKs. If you haven't set one up, the [quickstart](https://platform.claude.com/docs/en/managed-agents/quickstart#install-the-cli) covers installation and client setup.
37The examples use curl, the `ant` CLI, or the SDK. If you haven't set one up, the [quickstart](https://platform.claude.com/docs/en/managed-agents/quickstart#install-the-cli) covers installation and client setup.
3838
3939<CodeGroup defaultLanguage="CLI">
4040 ```bash cURL
from line 832
832832 </Card>
833833
834834 <Card title="Start a session" icon="play" href="https://platform.claude.com/docs/en/managed-agents/sessions">
835 Create a session to run your agent and begin executing tasks.
835 Create a session to run your agent and start running tasks.
836836 </Card>
837837
838838 <Card title="Reference" icon="book" href="https://platform.claude.com/docs/en/managed-agents/reference">
managed-agents/choosing-an-environment Changed · +1 / -1 lines
from line 13
1313An environment sets where your agent's tools and code run. They run in a sandbox. A sandbox is an isolated workspace, such as a container, where the agent runs commands and works on files. You have two options:
1414
1515* **Cloud environment:** Anthropic runs the sandbox for you. Each session gets its own fresh Linux container on Anthropic-managed infrastructure, with common languages, databases, and utilities already installed. You choose its network rules and any extra packages to install.
16* **Self-hosted sandbox:** You run the sandbox on your own infrastructure. Claude still runs on Anthropic's side and decides which tool to call next. A program that you run, called a worker, carries out the agent's bash and file tool calls on your machines and sends each result back. It can also serve custom tools.
16* **Self-hosted sandbox:** You run the sandbox on your own infrastructure. Claude still runs on Anthropic's side and determines which tool to call next. A program that you run, called a worker, carries out the agent's bash and file tool calls on your machines and sends each result back. It can also serve custom tools.
1717
1818The agent definition is the same whichever you choose. You set the model, prompt, and tools on the [agent](https://platform.claude.com/docs/en/managed-agents/agent-setup), not on the environment.
1919