One read of Claude Developer Platformapi-20261030T212610Z
396 pages moved out of 826 read.
Pages moved
396
significant first
Pages read
826
in this capture
Captured
21:26 UTC
Corpus hash
68200c8a9acb
corpus-hash
What this read moved
101-125 of 396, page 5 of 16This capture is too large to show at once. Changes 101-125 of 396 are below, significant first; the rest are on the following screens.
api/messages/batches/results Changed · +5 / -1 lines
from line 620
620620
621621 - `EncryptedCodeExecutionResultBlock object`
622622
623 Code execution result with encrypted stdout for PFC + web_search results.
623 The output and exit code of Python code that Claude ran with the code execution tool, with standard output in encrypted form.
624
625 The API returns this block in place of `code_execution_result` when the code called the web search tool.
626
627 See the [programmatic tool calling guide](https://platform.claude.com/docs/en/agents-and-tools/tool-use/programmatic-tool-calling?sdk_languages=http) to learn more about programmatic tool calling.
624628
625629 - `type: "encrypted_code_execution_result"`
626630
api/messages/count_tokens Changed · +6 / -2 lines
from line 854
854854
855855 - `EncryptedCodeExecutionResultBlockParam object`
856856
857 Code execution result with encrypted stdout for PFC + web_search results.
857 The output and exit code of Python code that Claude ran with the code execution tool, with standard output in encrypted form, sent back in a later request.
858858
859859 - `type: "encrypted_code_execution_result"`
860860
from line 1563
15631563
15641564 - `CodeExecutionTool20260120 object`
15651565
1566 Code execution tool with REPL state persistence (daemon mode + gVisor checkpoint).
1566 A `tools` entry for the code execution tool, version `code_execution_20260120`. It adds REPL state persistence to version `code_execution_20250825`.
1567
1568 REPL state persistence applies with programmatic tool calling. With it, the Python interpreter state, such as variable bindings, persists across requests that reuse the container.
1569
1570 See the [code execution tool guide](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool?sdk_languages=http#tool-versions) to learn what each tool version adds.
15671571
15681572 - `type: "code_execution_20260120"`
15691573
api/messages/create Changed · +11 / -3 lines
from line 866
866866
867867 - `EncryptedCodeExecutionResultBlockParam object`
868868
869 Code execution result with encrypted stdout for PFC + web_search results.
869 The output and exit code of Python code that Claude ran with the code execution tool, with standard output in encrypted form, sent back in a later request.
870870
871871 - `type: "encrypted_code_execution_result"`
872872
from line 1665
16651665
16661666 - `CodeExecutionTool20260120 object`
16671667
1668 Code execution tool with REPL state persistence (daemon mode + gVisor checkpoint).
1668 A `tools` entry for the code execution tool, version `code_execution_20260120`. It adds REPL state persistence to version `code_execution_20250825`.
16691669
1670 REPL state persistence applies with programmatic tool calling. With it, the Python interpreter state, such as variable bindings, persists across requests that reuse the container.
1671
1672 See the [code execution tool guide](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool?sdk_languages=http#tool-versions) to learn what each tool version adds.
1673
16701674 - `type: "code_execution_20260120"`
16711675
16721676 - `name: "code_execution"`
from line 3652
36483652
36493653 - `EncryptedCodeExecutionResultBlock object`
36503654
3651 Code execution result with encrypted stdout for PFC + web_search results.
3655 The output and exit code of Python code that Claude ran with the code execution tool, with standard output in encrypted form.
3656
3657 The API returns this block in place of `code_execution_result` when the code called the web search tool.
3658
3659 See the [programmatic tool calling guide](https://platform.claude.com/docs/en/agents-and-tools/tool-use/programmatic-tool-calling?sdk_languages=http) to learn more about programmatic tool calling.
36523660
36533661 - `type: "encrypted_code_execution_result"`
36543662
api/organization Changed · +216 / -153 lines
from line 306
306306 "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
307307 "created_at": "2024-10-30T23:58:27.427722Z",
308308 "created_by": {
309 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
309 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
310310 "type": "user"
311311 },
312312 "expires_at": "2024-10-30T23:58:27.427722Z",
from line 314
314314 "partial_key_hint": "sk-ant-api03-R2D...igAA",
315315 "principal": {
316316 "type": "user_actor",
317 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
317 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
318318 },
319319 "scope": {
320320 "type": "workspace",
from line 483
483483 "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
484484 "created_at": "2024-10-30T23:58:27.427722Z",
485485 "created_by": {
486 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
486 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
487487 "type": "user"
488488 },
489489 "expires_at": "2024-10-30T23:58:27.427722Z",
from line 491
491491 "partial_key_hint": "sk-ant-api03-R2D...igAA",
492492 "principal": {
493493 "type": "user_actor",
494 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
494 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
495495 },
496496 "scope": {
497497 "type": "workspace",
from line 675
675675 "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
676676 "created_at": "2024-10-30T23:58:27.427722Z",
677677 "created_by": {
678 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
678 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
679679 "type": "user"
680680 },
681681 "expires_at": "2024-10-30T23:58:27.427722Z",
from line 683
683683 "partial_key_hint": "sk-ant-api03-R2D...igAA",
684684 "principal": {
685685 "type": "user_actor",
686 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
686 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
687687 },
688688 "scope": {
689689 "type": "workspace",
from line 722
722722
723723 - `kms_arn: string`
724724
725 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
725 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
726726
727727 maxLength: 2048
728728
from line 734
734734
735735 **Deprecated**
736736
737 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
737 IAM role ARN. Deprecated; this field is ignored.
738738
739739 - `GCPExternalKeyConfig object`
740740
from line 776
776776
777777 Data residency geo. Only `us` is supported.
778778
779- `user_profile_id: optional string or null`
780
781 ID of a user profile to bind the key to. Omit this field for a key that isn't bound to a user profile. Such a key can be attached to a Workspace whatever its user profile. The binding cannot be changed later. A key bound to a user profile can only be attached to a Workspace that has the same user profile.
782
779783#### Returns
780784
781785- `ExternalKey object`
from line 796
792796
793797 - `id: string`
794798
795 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
799 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
796800
797801 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
798802
from line 824
820824
821825 - `geo: string`
822826
823 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
827 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
824828
825829 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
826830
from line 836
832836
833837 - `kms_arn: string`
834838
835 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
839 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
836840
837841 maxLength: 2048
838842
from line 848
844848
845849 **Deprecated**
846850
847 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
851 IAM role ARN. Deprecated; this field is ignored.
848852
849853 - `GCPExternalKeyConfig object`
850854
from line 882
878882
879883 format: date-time
880884
885 - `user_profile_id: string or null`
886
887 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
888
881889#### Example
882890
883891```bash
from line 897
889897 "provider_config": {
890898 "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
891899 "type": "aws"
892 }
900 },
901 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
893902 }'
894903```
895904
from line 920
911920 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
912921 },
913922 "type": "external_key",
914 "updated_at": "2024-10-30T23:58:27.427722Z"
923 "updated_at": "2024-10-30T23:58:27.427722Z",
924 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
915925}
916926```
917927
from line 964
954964
955965 - `id: string`
956966
957 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
967 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
958968
959969 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
960970
from line 992
982992
983993 - `geo: string`
984994
985 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
995 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
986996
987997 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
988998
from line 1004
9941004
9951005 - `kms_arn: string`
9961006
997 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
1007 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
9981008
9991009 maxLength: 2048
10001010
from line 1016
10061016
10071017 **Deprecated**
10081018
1009 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
1019 IAM role ARN. Deprecated; this field is ignored.
10101020
10111021 - `GCPExternalKeyConfig object`
10121022
from line 1050
10401050
10411051 format: date-time
10421052
1053 - `user_profile_id: string or null`
1054
1055 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
1056
10431057- `next_page: string or null`
10441058
10451059 Opaque cursor for the next page, or null if no more results. Pass as `?page=` to fetch the next page.
from line 1086
10721086 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
10731087 },
10741088 "type": "external_key",
1075 "updated_at": "2024-10-30T23:58:27.427722Z"
1089 "updated_at": "2024-10-30T23:58:27.427722Z",
1090 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
10761091 }
10771092 ],
10781093 "next_page": "next_page"
from line 1132
11171132
11181133 - `id: string`
11191134
1120 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
1135 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
11211136
11221137 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
11231138
from line 1160
11451160
11461161 - `geo: string`
11471162
1148 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
1163 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
11491164
11501165 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
11511166
from line 1172
11571172
11581173 - `kms_arn: string`
11591174
1160 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
1175 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
11611176
11621177 maxLength: 2048
11631178
from line 1184
11691184
11701185 **Deprecated**
11711186
1172 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
1187 IAM role ARN. Deprecated; this field is ignored.
11731188
11741189 - `GCPExternalKeyConfig object`
11751190
from line 1218
12031218
12041219 format: date-time
12051220
1221 - `user_profile_id: string or null`
1222
1223 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
1224
12061225#### Example
12071226
12081227```bash
from line 1248
12291248 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
12301249 },
12311250 "type": "external_key",
1232 "updated_at": "2024-10-30T23:58:27.427722Z"
1251 "updated_at": "2024-10-30T23:58:27.427722Z",
1252 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
12331253}
12341254```
12351255
from line 1301
12811301
12821302 - `kms_arn: string`
12831303
1284 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
1304 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
12851305
12861306 maxLength: 2048
12871307
from line 1313
12931313
12941314 **Deprecated**
12951315
1296 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
1316 IAM role ARN. Deprecated; this field is ignored.
12971317
12981318 - `GCPExternalKeyConfig object`
12991319
from line 1361
13411361
13421362 - `id: string`
13431363
1344 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
1364 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
13451365
13461366 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
13471367
from line 1389
13691389
13701390 - `geo: string`
13711391
1372 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
1392 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
13731393
13741394 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
13751395
from line 1401
13811401
13821402 - `kms_arn: string`
13831403
1384 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
1404 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
13851405
13861406 maxLength: 2048
13871407
from line 1413
13931413
13941414 **Deprecated**
13951415
1396 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
1416 IAM role ARN. Deprecated; this field is ignored.
13971417
13981418 - `GCPExternalKeyConfig object`
13991419
from line 1447
14271447
14281448 format: date-time
14291449
1450 - `user_profile_id: string or null`
1451
1452 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
1453
14301454#### Example
14311455
14321456```bash
from line 1479
14551479 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
14561480 },
14571481 "type": "external_key",
1458 "updated_at": "2024-10-30T23:58:27.427722Z"
1482 "updated_at": "2024-10-30T23:58:27.427722Z",
1483 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
14591484}
14601485```
14611486
from line 5857
58325857{
58335858 "data": [
58345859 {
5835 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
5860 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
58365861 "added_at": "2024-10-30T23:58:27.427722Z",
58385863 "name": "Jane Doe",
from line 5955
59305955
59315956```json
59325957{
5933 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
5958 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
59345959 "added_at": "2024-10-30T23:58:27.427722Z",
59365961 "name": "Jane Doe",
from line 6070
60456070
60466071```json
60476072{
6048 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
6073 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
60496074 "added_at": "2024-10-30T23:58:27.427722Z",
60516076 "name": "Jane Doe",
from line 6126
61016126
61026127```json
61036128{
6104 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
6129 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
61056130 "type": "user_deleted"
61066131}
61076132```
from line 6201
61766201
61776202 - `compartment_id: string`
61786203
6179 Identifier for this Workspace's encryption compartment. When you configure a
6180 customer-managed encryption key (CMEK) on AWS, reference this value in your
6181 KMS key-policy condition so the key is scoped to this compartment. On GCP and
6182 Azure, Anthropic enforces the compartment binding automatically; you do not
6183 need to reference this value in your key configuration. See the CMEK
6184 integration guide for the required key configuration; unless your organization
6185 is on Claude Platform on AWS, it includes a separate value used during key
6186 validation. On Claude Platform on AWS there is no separate validation value:
6187 the key is validated against this Workspace's own value when it is attached, so
6188 if your key policy uses the compartment condition, add this value to it before
6189 attaching the key.
6204 Identifier for this Workspace's encryption compartment. When you configure an
6205 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
6206 profile, reference this value in your KMS key-policy condition so the key is
6207 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
6208 binding automatically; you do not need to reference this value in your key
6209 configuration. See the CMEK integration guide for the required key
6210 configuration; unless your organization is on Claude Platform on AWS, it
6211 includes a separate value used during key validation. On Claude Platform on AWS
6212 there is no separate validation value: your organization's own key is validated
6213 against this Workspace's own value when it is attached, so if its key policy
6214 uses the compartment condition, add this value to it before attaching the key.
61906215
61916216 - `created_at: string`
61926217
from line 6257
62326257 Workspace. Setting this field requires CMEK to be enabled for your
62336258 organization. When set, data stored for this Workspace is encrypted with the
62346259 referenced key. Create key configurations with the External Keys API. On
6235 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
6236 single-Region key in the same AWS account and Region as the Workspace. On that
6237 platform the key is validated against this Workspace when it is attached, so a
6238 key-policy problem is reported as an error on this request. This field is write-once:
6239 once a key is attached to a Workspace it cannot be detached or replaced. To
6240 rotate key material, rotate the underlying key on your cloud KMS; the
6241 `external_key_id` stays the same.
6260 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
6261 organization's own key must be a single-Region key in the same AWS account and
6262 Region as the Workspace. On that platform the key is validated against this
6263 Workspace when it is attached, so a key-policy problem is reported as an error
6264 on this request. This field is write-once: once a key is attached to a Workspace
6265 it cannot be detached or replaced. To rotate key material, rotate the underlying
6266 key on your cloud KMS; the `external_key_id` stays the same.
62426267
62436268 - `name: string`
62446269
from line 6273
62486273
62496274 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
62506275
6276 - `user_profile_id: string or null`
6277
6278 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
6279
62516280- `first_id: string or null`
62526281
62536282 First ID in the `data` list. Can be used as the `before_id` for the previous page.
from line 6319
62906319 "env": "prod",
62916320 "team": "platform"
62926321 },
6293 "type": "workspace"
6322 "type": "workspace",
6323 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
62946324 }
62956325 ],
62966326 "first_id": "first_id",
from line 6391
63616391 Workspace. Setting this field requires CMEK to be enabled for your
63626392 organization. When set, data stored for this Workspace is encrypted with the
63636393 referenced key. Create key configurations with the External Keys API. On
6364 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
6365 single-Region key in the same AWS account and Region as the Workspace. On that
6366 platform the key is validated against this Workspace when it is attached, so a
6367 key-policy problem is reported as an error on this request. This field is write-once:
6368 once a key is attached to a Workspace it cannot be detached or replaced. To
6369 rotate key material, rotate the underlying key on your cloud KMS; the
6370 `external_key_id` stays the same.
6394 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
6395 organization's own key must be a single-Region key in the same AWS account and
6396 Region as the Workspace. On that platform the key is validated against this
6397 Workspace when it is attached, so a key-policy problem is reported as an error
6398 on this request. This field is write-once: once a key is attached to a Workspace
6399 it cannot be detached or replaced. To rotate key material, rotate the underlying
6400 key on your cloud KMS; the `external_key_id` stays the same.
63716401
63726402- `tags: optional map[string] or null`
63736403
63746404 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
63756405
6406- `user_profile_id: optional string or null`
6407
6408 ID of a user profile to attach to the Workspace. Every inference request through the Workspace must then name this user profile; the API rejects a request that names none or a different one. The user profile can't be replaced or removed later; only deleting the user profile clears it.
6409
63766410#### Returns
63776411
63786412- `Workspace object`
from line 6431
63976431
63986432 - `compartment_id: string`
63996433
6400 Identifier for this Workspace's encryption compartment. When you configure a
6401 customer-managed encryption key (CMEK) on AWS, reference this value in your
6402 KMS key-policy condition so the key is scoped to this compartment. On GCP and
6403 Azure, Anthropic enforces the compartment binding automatically; you do not
6404 need to reference this value in your key configuration. See the CMEK
6405 integration guide for the required key configuration; unless your organization
6406 is on Claude Platform on AWS, it includes a separate value used during key
6407 validation. On Claude Platform on AWS there is no separate validation value:
6408 the key is validated against this Workspace's own value when it is attached, so
6409 if your key policy uses the compartment condition, add this value to it before
6410 attaching the key.
6434 Identifier for this Workspace's encryption compartment. When you configure an
6435 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
6436 profile, reference this value in your KMS key-policy condition so the key is
6437 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
6438 binding automatically; you do not need to reference this value in your key
6439 configuration. See the CMEK integration guide for the required key
6440 configuration; unless your organization is on Claude Platform on AWS, it
6441 includes a separate value used during key validation. On Claude Platform on AWS
6442 there is no separate validation value: your organization's own key is validated
6443 against this Workspace's own value when it is attached, so if its key policy
6444 uses the compartment condition, add this value to it before attaching the key.
64116445
64126446 - `created_at: string`
64136447
from line 6487
64536487 Workspace. Setting this field requires CMEK to be enabled for your
64546488 organization. When set, data stored for this Workspace is encrypted with the
64556489 referenced key. Create key configurations with the External Keys API. On
6456 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
6457 single-Region key in the same AWS account and Region as the Workspace. On that
6458 platform the key is validated against this Workspace when it is attached, so a
6459 key-policy problem is reported as an error on this request. This field is write-once:
6460 once a key is attached to a Workspace it cannot be detached or replaced. To
6461 rotate key material, rotate the underlying key on your cloud KMS; the
6462 `external_key_id` stays the same.
6490 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
6491 organization's own key must be a single-Region key in the same AWS account and
6492 Region as the Workspace. On that platform the key is validated against this
6493 Workspace when it is attached, so a key-policy problem is reported as an error
6494 on this request. This field is write-once: once a key is attached to a Workspace
6495 it cannot be detached or replaced. To rotate key material, rotate the underlying
6496 key on your cloud KMS; the `external_key_id` stays the same.
64636497
64646498 - `name: string`
64656499
from line 6503
64696503
64706504 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
64716505
6506 - `user_profile_id: string or null`
6507
6508 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
6509
64726510#### Example
64736511
64746512```bash
from line 6521
64836521 "tags": {
64846522 "env": "prod",
64856523 "team": "platform"
6486 }
6524 },
6525 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
64876526 }'
64886527```
64896528
from line 6546
65076546 "env": "prod",
65086547 "team": "platform"
65096548 },
6510 "type": "workspace"
6549 "type": "workspace",
6550 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
65116551}
65126552```
65136553
from line 6595
65556595
65566596 - `compartment_id: string`
65576597
6558 Identifier for this Workspace's encryption compartment. When you configure a
6559 customer-managed encryption key (CMEK) on AWS, reference this value in your
6560 KMS key-policy condition so the key is scoped to this compartment. On GCP and
6561 Azure, Anthropic enforces the compartment binding automatically; you do not
6562 need to reference this value in your key configuration. See the CMEK
6563 integration guide for the required key configuration; unless your organization
6564 is on Claude Platform on AWS, it includes a separate value used during key
6565 validation. On Claude Platform on AWS there is no separate validation value:
6566 the key is validated against this Workspace's own value when it is attached, so
6567 if your key policy uses the compartment condition, add this value to it before
6568 attaching the key.
6598 Identifier for this Workspace's encryption compartment. When you configure an
6599 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
6600 profile, reference this value in your KMS key-policy condition so the key is
6601 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
6602 binding automatically; you do not need to reference this value in your key
6603 configuration. See the CMEK integration guide for the required key
6604 configuration; unless your organization is on Claude Platform on AWS, it
6605 includes a separate value used during key validation. On Claude Platform on AWS
6606 there is no separate validation value: your organization's own key is validated
6607 against this Workspace's own value when it is attached, so if its key policy
6608 uses the compartment condition, add this value to it before attaching the key.
65696609
65706610 - `created_at: string`
65716611
from line 6651
66116651 Workspace. Setting this field requires CMEK to be enabled for your
66126652 organization. When set, data stored for this Workspace is encrypted with the
66136653 referenced key. Create key configurations with the External Keys API. On
6614 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
6615 single-Region key in the same AWS account and Region as the Workspace. On that
6616 platform the key is validated against this Workspace when it is attached, so a
6617 key-policy problem is reported as an error on this request. This field is write-once:
6618 once a key is attached to a Workspace it cannot be detached or replaced. To
6619 rotate key material, rotate the underlying key on your cloud KMS; the
6620 `external_key_id` stays the same.
6654 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
6655 organization's own key must be a single-Region key in the same AWS account and
6656 Region as the Workspace. On that platform the key is validated against this
6657 Workspace when it is attached, so a key-policy problem is reported as an error
6658 on this request. This field is write-once: once a key is attached to a Workspace
6659 it cannot be detached or replaced. To rotate key material, rotate the underlying
6660 key on your cloud KMS; the `external_key_id` stays the same.
66216661
66226662 - `name: string`
66236663
from line 6667
66276667
66286668 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
66296669
6670 - `user_profile_id: string or null`
6671
6672 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
6673
66306674#### Example
66316675
66326676```bash
from line 6699
66556699 "env": "prod",
66566700 "team": "platform"
66576701 },
6658 "type": "workspace"
6702 "type": "workspace",
6703 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
66596704}
66606705```
66616706
from line 6760
67156760 Workspace. Setting this field requires CMEK to be enabled for your
67166761 organization. When set, data stored for this Workspace is encrypted with the
67176762 referenced key. Create key configurations with the External Keys API. On
6718 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
6719 single-Region key in the same AWS account and Region as the Workspace. On that
6720 platform the key is validated against this Workspace when it is attached, so a
6721 key-policy problem is reported as an error on this request. This field is write-once:
6722 once a key is attached to a Workspace it cannot be detached or replaced. To
6723 rotate key material, rotate the underlying key on your cloud KMS; the
6724 `external_key_id` stays the same.
6763 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
6764 organization's own key must be a single-Region key in the same AWS account and
6765 Region as the Workspace. On that platform the key is validated against this
6766 Workspace when it is attached, so a key-policy problem is reported as an error
6767 on this request. This field is write-once: once a key is attached to a Workspace
6768 it cannot be detached or replaced. To rotate key material, rotate the underlying
6769 key on your cloud KMS; the `external_key_id` stays the same.
67256770
67266771- `name: optional string`
67276772
from line 6778
67336778
67346779 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
67356780
6781- `user_profile_id: optional string`
6782
6783 ID of a user profile to attach to the Workspace. Every inference request through the Workspace must then name this user profile; the API rejects a request that names none or a different one. Once set, it can't be replaced or removed (sending the same ID again changes nothing); only deleting the user profile clears it. The default Workspace can't have a user profile.
6784
67366785#### Returns
67376786
67386787- `Workspace object`
from line 6806
67576806
67586807 - `compartment_id: string`
67596808
6760 Identifier for this Workspace's encryption compartment. When you configure a
6761 customer-managed encryption key (CMEK) on AWS, reference this value in your
6762 KMS key-policy condition so the key is scoped to this compartment. On GCP and
6763 Azure, Anthropic enforces the compartment binding automatically; you do not
6764 need to reference this value in your key configuration. See the CMEK
6765 integration guide for the required key configuration; unless your organization
6766 is on Claude Platform on AWS, it includes a separate value used during key
6767 validation. On Claude Platform on AWS there is no separate validation value:
6768 the key is validated against this Workspace's own value when it is attached, so
6769 if your key policy uses the compartment condition, add this value to it before
6770 attaching the key.
6809 Identifier for this Workspace's encryption compartment. When you configure an
6810 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
6811 profile, reference this value in your KMS key-policy condition so the key is
6812 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
6813 binding automatically; you do not need to reference this value in your key
6814 configuration. See the CMEK integration guide for the required key
6815 configuration; unless your organization is on Claude Platform on AWS, it
6816 includes a separate value used during key validation. On Claude Platform on AWS
6817 there is no separate validation value: your organization's own key is validated
6818 against this Workspace's own value when it is attached, so if its key policy
6819 uses the compartment condition, add this value to it before attaching the key.
67716820
67726821 - `created_at: string`
67736822
from line 6862
68136862 Workspace. Setting this field requires CMEK to be enabled for your
68146863 organization. When set, data stored for this Workspace is encrypted with the
68156864 referenced key. Create key configurations with the External Keys API. On
6816 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
6817 single-Region key in the same AWS account and Region as the Workspace. On that
6818 platform the key is validated against this Workspace when it is attached, so a
6819 key-policy problem is reported as an error on this request. This field is write-once:
6820 once a key is attached to a Workspace it cannot be detached or replaced. To
6821 rotate key material, rotate the underlying key on your cloud KMS; the
6822 `external_key_id` stays the same.
6865 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
6866 organization's own key must be a single-Region key in the same AWS account and
6867 Region as the Workspace. On that platform the key is validated against this
6868 Workspace when it is attached, so a key-policy problem is reported as an error
6869 on this request. This field is write-once: once a key is attached to a Workspace
6870 it cannot be detached or replaced. To rotate key material, rotate the underlying
6871 key on your cloud KMS; the `external_key_id` stays the same.
68236872
68246873 - `name: string`
68256874
from line 6878
68296878
68306879 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
68316880
6881 - `user_profile_id: string or null`
6882
6883 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
6884
68326885#### Example
68336886
68346887```bash
from line 6895
68426895 "tags": {
68436896 "env": "prod",
68446897 "team": "platform"
6845 }
6898 },
6899 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
68466900 }'
68476901```
68486902
from line 6920
68666920 "env": "prod",
68676921 "team": "platform"
68686922 },
6869 "type": "workspace"
6923 "type": "workspace",
6924 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
68706925}
68716926```
68726927
from line 6967
69126967
69136968 - `compartment_id: string`
69146969
6915 Identifier for this Workspace's encryption compartment. When you configure a
6916 customer-managed encryption key (CMEK) on AWS, reference this value in your
6917 KMS key-policy condition so the key is scoped to this compartment. On GCP and
6918 Azure, Anthropic enforces the compartment binding automatically; you do not
6919 need to reference this value in your key configuration. See the CMEK
6920 integration guide for the required key configuration; unless your organization
6921 is on Claude Platform on AWS, it includes a separate value used during key
6922 validation. On Claude Platform on AWS there is no separate validation value:
6923 the key is validated against this Workspace's own value when it is attached, so
6924 if your key policy uses the compartment condition, add this value to it before
6925 attaching the key.
6970 Identifier for this Workspace's encryption compartment. When you configure an
6971 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
6972 profile, reference this value in your KMS key-policy condition so the key is
6973 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
6974 binding automatically; you do not need to reference this value in your key
6975 configuration. See the CMEK integration guide for the required key
6976 configuration; unless your organization is on Claude Platform on AWS, it
6977 includes a separate value used during key validation. On Claude Platform on AWS
6978 there is no separate validation value: your organization's own key is validated
6979 against this Workspace's own value when it is attached, so if its key policy
6980 uses the compartment condition, add this value to it before attaching the key.
69266981
69276982 - `created_at: string`
69286983
from line 7023
69687023 Workspace. Setting this field requires CMEK to be enabled for your
69697024 organization. When set, data stored for this Workspace is encrypted with the
69707025 referenced key. Create key configurations with the External Keys API. On
6971 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
6972 single-Region key in the same AWS account and Region as the Workspace. On that
6973 platform the key is validated against this Workspace when it is attached, so a
6974 key-policy problem is reported as an error on this request. This field is write-once:
6975 once a key is attached to a Workspace it cannot be detached or replaced. To
6976 rotate key material, rotate the underlying key on your cloud KMS; the
6977 `external_key_id` stays the same.
7026 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
7027 organization's own key must be a single-Region key in the same AWS account and
7028 Region as the Workspace. On that platform the key is validated against this
7029 Workspace when it is attached, so a key-policy problem is reported as an error
7030 on this request. This field is write-once: once a key is attached to a Workspace
7031 it cannot be detached or replaced. To rotate key material, rotate the underlying
7032 key on your cloud KMS; the `external_key_id` stays the same.
69787033
69797034 - `name: string`
69807035
from line 7039
69847039
69857040 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
69867041
7042 - `user_profile_id: string or null`
7043
7044 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
7045
69877046#### Example
69887047
69897048```bash
from line 7072
70137072 "env": "prod",
70147073 "team": "platform"
70157074 },
7016 "type": "workspace"
7075 "type": "workspace",
7076 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
70177077}
70187078```
70197079
from line 7684
76247684 "data": [
76257685 {
76267686 "type": "workspace_member",
7627 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
7687 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
76287688 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
76297689 "workspace_role": "workspace_admin"
76307690 }
from line 7775
77157775 -H 'anthropic-version: 2026-10-21' \
77167776 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \
77177777 -d '{
7718 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
7778 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
77197779 "workspace_role": "workspace_admin"
77207780 }'
77217781```
from line 7785
77257785```json
77267786{
77277787 "type": "workspace_member",
7728 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
7788 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
77297789 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
77307790 "workspace_role": "workspace_admin"
77317791}
from line 7862
78027862```json
78037863{
78047864 "type": "workspace_member",
7805 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
7865 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
78067866 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
78077867 "workspace_role": "workspace_admin"
78087868}
from line 7959
78997959```json
79007960{
79017961 "type": "workspace_member",
7902 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
7962 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
79037963 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
79047964 "workspace_role": "workspace_admin"
79057965}
from line 8021
79618021```json
79628022{
79638023 "type": "workspace_member_deleted",
7964 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
8024 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
79658025 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
79668026}
79678027```
from line 8799
87398799
87408800Setting `state` to `enabled` turns on the Compliance API and begins
87418801capturing organization activity events. Setting it to `disabled` turns
8742both off. `state` reflects whether the Compliance API is enabled.
8802both off. Access Transparency events are an exception: they are still
8803captured while the Compliance API is disabled, and the Compliance API
8804activity feed returns them once it is enabled again. `state` reflects
8805whether the Compliance API is enabled.
87438806
87448807A request that sets `state` to its current value succeeds and leaves the
87458808resource unchanged. A `disabled` request stays in effect until a later
api/organization/api_keys Changed · +6 / -6 lines
from line 204
204204 "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
205205 "created_at": "2024-10-30T23:58:27.427722Z",
206206 "created_by": {
207 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
207 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
208208 "type": "user"
209209 },
210210 "expires_at": "2024-10-30T23:58:27.427722Z",
from line 212
212212 "partial_key_hint": "sk-ant-api03-R2D...igAA",
213213 "principal": {
214214 "type": "user_actor",
215 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
215 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
216216 },
217217 "scope": {
218218 "type": "workspace",
from line 381
381381 "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
382382 "created_at": "2024-10-30T23:58:27.427722Z",
383383 "created_by": {
384 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
384 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
385385 "type": "user"
386386 },
387387 "expires_at": "2024-10-30T23:58:27.427722Z",
from line 389
389389 "partial_key_hint": "sk-ant-api03-R2D...igAA",
390390 "principal": {
391391 "type": "user_actor",
392 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
392 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
393393 },
394394 "scope": {
395395 "type": "workspace",
from line 573
573573 "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
574574 "created_at": "2024-10-30T23:58:27.427722Z",
575575 "created_by": {
576 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
576 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
577577 "type": "user"
578578 },
579579 "expires_at": "2024-10-30T23:58:27.427722Z",
from line 581
581581 "partial_key_hint": "sk-ant-api03-R2D...igAA",
582582 "principal": {
583583 "type": "user_actor",
584 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
584 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
585585 },
586586 "scope": {
587587 "type": "workspace",
api/organization/compliance_settings Changed · +4 / -1 lines
from line 75
7575
7676Setting `state` to `enabled` turns on the Compliance API and begins
7777capturing organization activity events. Setting it to `disabled` turns
78both off. `state` reflects whether the Compliance API is enabled.
78both off. Access Transparency events are an exception: they are still
79captured while the Compliance API is disabled, and the Compliance API
80activity feed returns them once it is enabled again. `state` reflects
81whether the Compliance API is enabled.
7982
8083A request that sets `state` to its current value succeeds and leaves the
8184resource unchanged. A `disabled` request stays in effect until a later
api/organization/compliance_settings/update Changed · +4 / -1 lines
from line 11
1111
1212Setting `state` to `enabled` turns on the Compliance API and begins
1313capturing organization activity events. Setting it to `disabled` turns
14both off. `state` reflects whether the Compliance API is enabled.
14both off. Access Transparency events are an exception: they are still
15captured while the Compliance API is disabled, and the Compliance API
16activity feed returns them once it is enabled again. `state` reflects
17whether the Compliance API is enabled.
1518
1619A request that sets `state` to its current value succeeds and leaves the
1720resource unchanged. A `disabled` request stays in effect until a later
api/organization/external_keys Changed · +60 / -31 lines
from line 31
3131
3232 - `kms_arn: string`
3333
34 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
34 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
3535
3636 maxLength: 2048
3737
from line 43
4343
4444 **Deprecated**
4545
46 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
46 IAM role ARN. Deprecated; this field is ignored.
4747
4848 - `GCPExternalKeyConfig object`
4949
from line 85
8585
8686 Data residency geo. Only `us` is supported.
8787
88- `user_profile_id: optional string or null`
89
90 ID of a user profile to bind the key to. Omit this field for a key that isn't bound to a user profile. Such a key can be attached to a Workspace whatever its user profile. The binding cannot be changed later. A key bound to a user profile can only be attached to a Workspace that has the same user profile.
91
8892### Returns
8993
9094- `ExternalKey object`
from line 105
101105
102106 - `id: string`
103107
104 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
108 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
105109
106110 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
107111
from line 133
129133
130134 - `geo: string`
131135
132 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
136 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
133137
134138 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
135139
from line 145
141145
142146 - `kms_arn: string`
143147
144 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
148 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
145149
146150 maxLength: 2048
147151
from line 157
153157
154158 **Deprecated**
155159
156 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
160 IAM role ARN. Deprecated; this field is ignored.
157161
158162 - `GCPExternalKeyConfig object`
159163
from line 191
187191
188192 format: date-time
189193
194 - `user_profile_id: string or null`
195
196 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
197
190198### Example
191199
192200```bash
from line 206
198206 "provider_config": {
199207 "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
200208 "type": "aws"
201 }
209 },
210 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
202211 }'
203212```
204213
from line 229
220229 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
221230 },
222231 "type": "external_key",
223 "updated_at": "2024-10-30T23:58:27.427722Z"
232 "updated_at": "2024-10-30T23:58:27.427722Z",
233 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
224234}
225235```
226236
from line 273
263273
264274 - `id: string`
265275
266 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
276 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
267277
268278 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
269279
from line 301
291301
292302 - `geo: string`
293303
294 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
304 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
295305
296306 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
297307
from line 313
303313
304314 - `kms_arn: string`
305315
306 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
316 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
307317
308318 maxLength: 2048
309319
from line 325
315325
316326 **Deprecated**
317327
318 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
328 IAM role ARN. Deprecated; this field is ignored.
319329
320330 - `GCPExternalKeyConfig object`
321331
from line 359
349359
350360 format: date-time
351361
362 - `user_profile_id: string or null`
363
364 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
365
352366- `next_page: string or null`
353367
354368 Opaque cursor for the next page, or null if no more results. Pass as `?page=` to fetch the next page.
from line 395
381395 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
382396 },
383397 "type": "external_key",
384 "updated_at": "2024-10-30T23:58:27.427722Z"
398 "updated_at": "2024-10-30T23:58:27.427722Z",
399 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
385400 }
386401 ],
387402 "next_page": "next_page"
from line 441
426441
427442 - `id: string`
428443
429 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
444 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
430445
431446 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
432447
from line 469
454469
455470 - `geo: string`
456471
457 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
472 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
458473
459474 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
460475
from line 481
466481
467482 - `kms_arn: string`
468483
469 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
484 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
470485
471486 maxLength: 2048
472487
from line 493
478493
479494 **Deprecated**
480495
481 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
496 IAM role ARN. Deprecated; this field is ignored.
482497
483498 - `GCPExternalKeyConfig object`
484499
from line 527
512527
513528 format: date-time
514529
530 - `user_profile_id: string or null`
531
532 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
533
515534### Example
516535
517536```bash
from line 557
538557 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
539558 },
540559 "type": "external_key",
541 "updated_at": "2024-10-30T23:58:27.427722Z"
560 "updated_at": "2024-10-30T23:58:27.427722Z",
561 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
542562}
543563```
544564
from line 610
590610
591611 - `kms_arn: string`
592612
593 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
613 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
594614
595615 maxLength: 2048
596616
from line 622
602622
603623 **Deprecated**
604624
605 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
625 IAM role ARN. Deprecated; this field is ignored.
606626
607627 - `GCPExternalKeyConfig object`
608628
from line 670
650670
651671 - `id: string`
652672
653 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
673 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
654674
655675 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
656676
from line 698
678698
679699 - `geo: string`
680700
681 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
701 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
682702
683703 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
684704
from line 710
690710
691711 - `kms_arn: string`
692712
693 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
713 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
694714
695715 maxLength: 2048
696716
from line 722
702722
703723 **Deprecated**
704724
705 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
725 IAM role ARN. Deprecated; this field is ignored.
706726
707727 - `GCPExternalKeyConfig object`
708728
from line 756
736756
737757 format: date-time
738758
759 - `user_profile_id: string or null`
760
761 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
762
739763### Example
740764
741765```bash
from line 788
764788 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
765789 },
766790 "type": "external_key",
767 "updated_at": "2024-10-30T23:58:27.427722Z"
791 "updated_at": "2024-10-30T23:58:27.427722Z",
792 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
768793}
769794```
770795
from line 919
894919
895920 - `kms_arn: string`
896921
897 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
922 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
898923
899924 maxLength: 2048
900925
from line 931
906931
907932 **Deprecated**
908933
909 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
934 IAM role ARN. Deprecated; this field is ignored.
910935
911936### Azure External Key Config
912937
from line 995
970995
971996 - `id: string`
972997
973 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
998 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
974999
9751000 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
9761001
from line 1023
9981023
9991024 - `geo: string`
10001025
1001 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
1026 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
10021027
10031028 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
10041029
from line 1035
10101035
10111036 - `kms_arn: string`
10121037
1013 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
1038 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
10141039
10151040 maxLength: 2048
10161041
from line 1047
10221047
10231048 **Deprecated**
10241049
1025 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
1050 IAM role ARN. Deprecated; this field is ignored.
10261051
10271052 - `GCPExternalKeyConfig object`
10281053
from line 1080
10551080 - `updated_at: string`
10561081
10571082 format: date-time
1083
1084 - `user_profile_id: string or null`
1085
1086 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
10581087
10591088### External Key Attached Attachment
10601089
api/organization/external_keys/create Changed · +18 / -8 lines
from line 29
2929
3030 - `kms_arn: string`
3131
32 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
32 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
3333
3434 maxLength: 2048
3535
from line 41
4141
4242 **Deprecated**
4343
44 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
44 IAM role ARN. Deprecated; this field is ignored.
4545
4646 - `GCPExternalKeyConfig object`
4747
from line 83
8383
8484 Data residency geo. Only `us` is supported.
8585
86- `user_profile_id: optional string or null`
87
88 ID of a user profile to bind the key to. Omit this field for a key that isn't bound to a user profile. Such a key can be attached to a Workspace whatever its user profile. The binding cannot be changed later. A key bound to a user profile can only be attached to a Workspace that has the same user profile.
89
8690## Returns
8791
8892- `ExternalKey object`
from line 103
99103
100104 - `id: string`
101105
102 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
106 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
103107
104108 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
105109
from line 131
127131
128132 - `geo: string`
129133
130 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
134 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
131135
132136 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
133137
from line 143
139143
140144 - `kms_arn: string`
141145
142 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
146 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
143147
144148 maxLength: 2048
145149
from line 155
151155
152156 **Deprecated**
153157
154 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
158 IAM role ARN. Deprecated; this field is ignored.
155159
156160 - `GCPExternalKeyConfig object`
157161
from line 189
185189
186190 format: date-time
187191
192 - `user_profile_id: string or null`
193
194 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
195
188196## Example
189197
190198```bash
from line 204
196204 "provider_config": {
197205 "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
198206 "type": "aws"
199 }
207 },
208 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
200209 }'
201210```
202211
from line 227
218227 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
219228 },
220229 "type": "external_key",
221 "updated_at": "2024-10-30T23:58:27.427722Z"
230 "updated_at": "2024-10-30T23:58:27.427722Z",
231 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
222232}
223233```
224234
api/organization/external_keys/list Changed · +10 / -5 lines
from line 42
4242
4343 - `id: string`
4444
45 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
45 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
4646
4747 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
4848
from line 70
7070
7171 - `geo: string`
7272
73 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
73 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
7474
7575 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
7676
from line 82
8282
8383 - `kms_arn: string`
8484
85 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
85 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
8686
8787 maxLength: 2048
8888
from line 94
9494
9595 **Deprecated**
9696
97 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
97 IAM role ARN. Deprecated; this field is ignored.
9898
9999 - `GCPExternalKeyConfig object`
100100
from line 128
128128
129129 format: date-time
130130
131 - `user_profile_id: string or null`
132
133 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
134
131135- `next_page: string or null`
132136
133137 Opaque cursor for the next page, or null if no more results. Pass as `?page=` to fetch the next page.
from line 164
160164 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
161165 },
162166 "type": "external_key",
163 "updated_at": "2024-10-30T23:58:27.427722Z"
167 "updated_at": "2024-10-30T23:58:27.427722Z",
168 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
164169 }
165170 ],
166171 "next_page": "next_page"
api/organization/external_keys/retrieve Changed · +10 / -5 lines
from line 41
4141
4242 - `id: string`
4343
44 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
44 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
4545
4646 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
4747
from line 69
6969
7070 - `geo: string`
7171
72 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
72 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
7373
7474 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
7575
from line 81
8181
8282 - `kms_arn: string`
8383
84 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
84 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
8585
8686 maxLength: 2048
8787
from line 93
9393
9494 **Deprecated**
9595
96 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
96 IAM role ARN. Deprecated; this field is ignored.
9797
9898 - `GCPExternalKeyConfig object`
9999
from line 127
127127
128128 format: date-time
129129
130 - `user_profile_id: string or null`
131
132 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
133
130134## Example
131135
132136```bash
from line 157
153157 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
154158 },
155159 "type": "external_key",
156 "updated_at": "2024-10-30T23:58:27.427722Z"
160 "updated_at": "2024-10-30T23:58:27.427722Z",
161 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
157162}
158163```
159164
api/organization/external_keys/update Changed · +12 / -7 lines
from line 51
5151
5252 - `kms_arn: string`
5353
54 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
54 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
5555
5656 maxLength: 2048
5757
from line 63
6363
6464 **Deprecated**
6565
66 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
66 IAM role ARN. Deprecated; this field is ignored.
6767
6868 - `GCPExternalKeyConfig object`
6969
from line 111
111111
112112 - `id: string`
113113
114 Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.
114 Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.
115115
116116 - `attachment: ExternalKeyAttachedAttachment or ExternalKeyUnattachedAttachment`
117117
from line 139
139139
140140 - `geo: string`
141141
142 Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.
142 Data residency geo. Selects the region that handles this key's encrypt/decrypt roundtrips.
143143
144144 - `provider_config: AWSExternalKeyConfig or GCPExternalKeyConfig or AzureExternalKeyConfig`
145145
from line 151
151151
152152 - `kms_arn: string`
153153
154 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.
154 Full ARN of the AWS KMS key. On Claude Platform on AWS, alias ARNs are rejected, and your organization's own key must be a single-Region key in your organization's AWS account.
155155
156156 maxLength: 2048
157157
from line 163
163163
164164 **Deprecated**
165165
166 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.
166 IAM role ARN. Deprecated; this field is ignored.
167167
168168 - `GCPExternalKeyConfig object`
169169
from line 197
197197
198198 format: date-time
199199
200 - `user_profile_id: string or null`
201
202 ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.
203
200204## Example
201205
202206```bash
from line 229
225229 "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
226230 },
227231 "type": "external_key",
228 "updated_at": "2024-10-30T23:58:27.427722Z"
232 "updated_at": "2024-10-30T23:58:27.427722Z",
233 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
229234}
230235```
231236
api/organization/users Changed · +4 / -4 lines
from line 127
127127{
128128 "data": [
129129 {
130 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
130 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
131131 "added_at": "2024-10-30T23:58:27.427722Z",
133133 "name": "Jane Doe",
from line 225
225225
226226```json
227227{
228 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
228 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
229229 "added_at": "2024-10-30T23:58:27.427722Z",
231231 "name": "Jane Doe",
from line 340
340340
341341```json
342342{
343 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
343 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
344344 "added_at": "2024-10-30T23:58:27.427722Z",
346346 "name": "Jane Doe",
from line 396
396396
397397```json
398398{
399 "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
399 "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
400400 "type": "user_deleted"
401401}
402402```
api/organization/workspaces Changed · +174 / -135 lines
from line 73
7373
7474 - `compartment_id: string`
7575
76 Identifier for this Workspace's encryption compartment. When you configure a
77 customer-managed encryption key (CMEK) on AWS, reference this value in your
78 KMS key-policy condition so the key is scoped to this compartment. On GCP and
79 Azure, Anthropic enforces the compartment binding automatically; you do not
80 need to reference this value in your key configuration. See the CMEK
81 integration guide for the required key configuration; unless your organization
82 is on Claude Platform on AWS, it includes a separate value used during key
83 validation. On Claude Platform on AWS there is no separate validation value:
84 the key is validated against this Workspace's own value when it is attached, so
85 if your key policy uses the compartment condition, add this value to it before
86 attaching the key.
76 Identifier for this Workspace's encryption compartment. When you configure an
77 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
78 profile, reference this value in your KMS key-policy condition so the key is
79 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
80 binding automatically; you do not need to reference this value in your key
81 configuration. See the CMEK integration guide for the required key
82 configuration; unless your organization is on Claude Platform on AWS, it
83 includes a separate value used during key validation. On Claude Platform on AWS
84 there is no separate validation value: your organization's own key is validated
85 against this Workspace's own value when it is attached, so if its key policy
86 uses the compartment condition, add this value to it before attaching the key.
8787
8888 - `created_at: string`
8989
from line 129
129129 Workspace. Setting this field requires CMEK to be enabled for your
130130 organization. When set, data stored for this Workspace is encrypted with the
131131 referenced key. Create key configurations with the External Keys API. On
132 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
133 single-Region key in the same AWS account and Region as the Workspace. On that
134 platform the key is validated against this Workspace when it is attached, so a
135 key-policy problem is reported as an error on this request. This field is write-once:
136 once a key is attached to a Workspace it cannot be detached or replaced. To
137 rotate key material, rotate the underlying key on your cloud KMS; the
138 `external_key_id` stays the same.
132 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
133 organization's own key must be a single-Region key in the same AWS account and
134 Region as the Workspace. On that platform the key is validated against this
135 Workspace when it is attached, so a key-policy problem is reported as an error
136 on this request. This field is write-once: once a key is attached to a Workspace
137 it cannot be detached or replaced. To rotate key material, rotate the underlying
138 key on your cloud KMS; the `external_key_id` stays the same.
139139
140140 - `name: string`
141141
from line 145
145145
146146 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
147147
148 - `user_profile_id: string or null`
149
150 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
151
148152- `first_id: string or null`
149153
150154 First ID in the `data` list. Can be used as the `before_id` for the previous page.
from line 191
187191 "env": "prod",
188192 "team": "platform"
189193 },
190 "type": "workspace"
194 "type": "workspace",
195 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
191196 }
192197 ],
193198 "first_id": "first_id",
from line 263
258263 Workspace. Setting this field requires CMEK to be enabled for your
259264 organization. When set, data stored for this Workspace is encrypted with the
260265 referenced key. Create key configurations with the External Keys API. On
261 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
262 single-Region key in the same AWS account and Region as the Workspace. On that
263 platform the key is validated against this Workspace when it is attached, so a
264 key-policy problem is reported as an error on this request. This field is write-once:
265 once a key is attached to a Workspace it cannot be detached or replaced. To
266 rotate key material, rotate the underlying key on your cloud KMS; the
267 `external_key_id` stays the same.
266 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
267 organization's own key must be a single-Region key in the same AWS account and
268 Region as the Workspace. On that platform the key is validated against this
269 Workspace when it is attached, so a key-policy problem is reported as an error
270 on this request. This field is write-once: once a key is attached to a Workspace
271 it cannot be detached or replaced. To rotate key material, rotate the underlying
272 key on your cloud KMS; the `external_key_id` stays the same.
268273
269274- `tags: optional map[string] or null`
270275
271276 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
272277
278- `user_profile_id: optional string or null`
279
280 ID of a user profile to attach to the Workspace. Every inference request through the Workspace must then name this user profile; the API rejects a request that names none or a different one. The user profile can't be replaced or removed later; only deleting the user profile clears it.
281
273282### Returns
274283
275284- `Workspace object`
from line 303
294303
295304 - `compartment_id: string`
296305
297 Identifier for this Workspace's encryption compartment. When you configure a
298 customer-managed encryption key (CMEK) on AWS, reference this value in your
299 KMS key-policy condition so the key is scoped to this compartment. On GCP and
300 Azure, Anthropic enforces the compartment binding automatically; you do not
301 need to reference this value in your key configuration. See the CMEK
302 integration guide for the required key configuration; unless your organization
303 is on Claude Platform on AWS, it includes a separate value used during key
304 validation. On Claude Platform on AWS there is no separate validation value:
305 the key is validated against this Workspace's own value when it is attached, so
306 if your key policy uses the compartment condition, add this value to it before
307 attaching the key.
306 Identifier for this Workspace's encryption compartment. When you configure an
307 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
308 profile, reference this value in your KMS key-policy condition so the key is
309 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
310 binding automatically; you do not need to reference this value in your key
311 configuration. See the CMEK integration guide for the required key
312 configuration; unless your organization is on Claude Platform on AWS, it
313 includes a separate value used during key validation. On Claude Platform on AWS
314 there is no separate validation value: your organization's own key is validated
315 against this Workspace's own value when it is attached, so if its key policy
316 uses the compartment condition, add this value to it before attaching the key.
308317
309318 - `created_at: string`
310319
from line 359
350359 Workspace. Setting this field requires CMEK to be enabled for your
351360 organization. When set, data stored for this Workspace is encrypted with the
352361 referenced key. Create key configurations with the External Keys API. On
353 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
354 single-Region key in the same AWS account and Region as the Workspace. On that
355 platform the key is validated against this Workspace when it is attached, so a
356 key-policy problem is reported as an error on this request. This field is write-once:
357 once a key is attached to a Workspace it cannot be detached or replaced. To
358 rotate key material, rotate the underlying key on your cloud KMS; the
359 `external_key_id` stays the same.
362 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
363 organization's own key must be a single-Region key in the same AWS account and
364 Region as the Workspace. On that platform the key is validated against this
365 Workspace when it is attached, so a key-policy problem is reported as an error
366 on this request. This field is write-once: once a key is attached to a Workspace
367 it cannot be detached or replaced. To rotate key material, rotate the underlying
368 key on your cloud KMS; the `external_key_id` stays the same.
360369
361370 - `name: string`
362371
from line 375
366375
367376 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
368377
378 - `user_profile_id: string or null`
379
380 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
381
369382### Example
370383
371384```bash
from line 393
380393 "tags": {
381394 "env": "prod",
382395 "team": "platform"
383 }
396 },
397 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
384398 }'
385399```
386400
from line 418
404418 "env": "prod",
405419 "team": "platform"
406420 },
407 "type": "workspace"
421 "type": "workspace",
422 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
408423}
409424```
410425
from line 467
452467
453468 - `compartment_id: string`
454469
455 Identifier for this Workspace's encryption compartment. When you configure a
456 customer-managed encryption key (CMEK) on AWS, reference this value in your
457 KMS key-policy condition so the key is scoped to this compartment. On GCP and
458 Azure, Anthropic enforces the compartment binding automatically; you do not
459 need to reference this value in your key configuration. See the CMEK
460 integration guide for the required key configuration; unless your organization
461 is on Claude Platform on AWS, it includes a separate value used during key
462 validation. On Claude Platform on AWS there is no separate validation value:
463 the key is validated against this Workspace's own value when it is attached, so
464 if your key policy uses the compartment condition, add this value to it before
465 attaching the key.
470 Identifier for this Workspace's encryption compartment. When you configure an
471 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
472 profile, reference this value in your KMS key-policy condition so the key is
473 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
474 binding automatically; you do not need to reference this value in your key
475 configuration. See the CMEK integration guide for the required key
476 configuration; unless your organization is on Claude Platform on AWS, it
477 includes a separate value used during key validation. On Claude Platform on AWS
478 there is no separate validation value: your organization's own key is validated
479 against this Workspace's own value when it is attached, so if its key policy
480 uses the compartment condition, add this value to it before attaching the key.
466481
467482 - `created_at: string`
468483
from line 523
508523 Workspace. Setting this field requires CMEK to be enabled for your
509524 organization. When set, data stored for this Workspace is encrypted with the
510525 referenced key. Create key configurations with the External Keys API. On
511 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
512 single-Region key in the same AWS account and Region as the Workspace. On that
513 platform the key is validated against this Workspace when it is attached, so a
514 key-policy problem is reported as an error on this request. This field is write-once:
515 once a key is attached to a Workspace it cannot be detached or replaced. To
516 rotate key material, rotate the underlying key on your cloud KMS; the
517 `external_key_id` stays the same.
526 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
527 organization's own key must be a single-Region key in the same AWS account and
528 Region as the Workspace. On that platform the key is validated against this
529 Workspace when it is attached, so a key-policy problem is reported as an error
530 on this request. This field is write-once: once a key is attached to a Workspace
531 it cannot be detached or replaced. To rotate key material, rotate the underlying
532 key on your cloud KMS; the `external_key_id` stays the same.
518533
519534 - `name: string`
520535
from line 539
524539
525540 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
526541
542 - `user_profile_id: string or null`
543
544 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
545
527546### Example
528547
529548```bash
from line 571
552571 "env": "prod",
553572 "team": "platform"
554573 },
555 "type": "workspace"
574 "type": "workspace",
575 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
556576}
557577```
558578
from line 632
612632 Workspace. Setting this field requires CMEK to be enabled for your
613633 organization. When set, data stored for this Workspace is encrypted with the
614634 referenced key. Create key configurations with the External Keys API. On
615 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
616 single-Region key in the same AWS account and Region as the Workspace. On that
617 platform the key is validated against this Workspace when it is attached, so a
618 key-policy problem is reported as an error on this request. This field is write-once:
619 once a key is attached to a Workspace it cannot be detached or replaced. To
620 rotate key material, rotate the underlying key on your cloud KMS; the
621 `external_key_id` stays the same.
635 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
636 organization's own key must be a single-Region key in the same AWS account and
637 Region as the Workspace. On that platform the key is validated against this
638 Workspace when it is attached, so a key-policy problem is reported as an error
639 on this request. This field is write-once: once a key is attached to a Workspace
640 it cannot be detached or replaced. To rotate key material, rotate the underlying
641 key on your cloud KMS; the `external_key_id` stays the same.
622642
623643- `name: optional string`
624644
from line 650
630650
631651 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
632652
653- `user_profile_id: optional string`
654
655 ID of a user profile to attach to the Workspace. Every inference request through the Workspace must then name this user profile; the API rejects a request that names none or a different one. Once set, it can't be replaced or removed (sending the same ID again changes nothing); only deleting the user profile clears it. The default Workspace can't have a user profile.
656
633657### Returns
634658
635659- `Workspace object`
from line 678
654678
655679 - `compartment_id: string`
656680
657 Identifier for this Workspace's encryption compartment. When you configure a
658 customer-managed encryption key (CMEK) on AWS, reference this value in your
659 KMS key-policy condition so the key is scoped to this compartment. On GCP and
660 Azure, Anthropic enforces the compartment binding automatically; you do not
661 need to reference this value in your key configuration. See the CMEK
662 integration guide for the required key configuration; unless your organization
663 is on Claude Platform on AWS, it includes a separate value used during key
664 validation. On Claude Platform on AWS there is no separate validation value:
665 the key is validated against this Workspace's own value when it is attached, so
666 if your key policy uses the compartment condition, add this value to it before
667 attaching the key.
681 Identifier for this Workspace's encryption compartment. When you configure an
682 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
683 profile, reference this value in your KMS key-policy condition so the key is
684 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
685 binding automatically; you do not need to reference this value in your key
686 configuration. See the CMEK integration guide for the required key
687 configuration; unless your organization is on Claude Platform on AWS, it
688 includes a separate value used during key validation. On Claude Platform on AWS
689 there is no separate validation value: your organization's own key is validated
690 against this Workspace's own value when it is attached, so if its key policy
691 uses the compartment condition, add this value to it before attaching the key.
668692
669693 - `created_at: string`
670694
from line 734
710734 Workspace. Setting this field requires CMEK to be enabled for your
711735 organization. When set, data stored for this Workspace is encrypted with the
712736 referenced key. Create key configurations with the External Keys API. On
713 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
714 single-Region key in the same AWS account and Region as the Workspace. On that
715 platform the key is validated against this Workspace when it is attached, so a
716 key-policy problem is reported as an error on this request. This field is write-once:
717 once a key is attached to a Workspace it cannot be detached or replaced. To
718 rotate key material, rotate the underlying key on your cloud KMS; the
719 `external_key_id` stays the same.
737 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
738 organization's own key must be a single-Region key in the same AWS account and
739 Region as the Workspace. On that platform the key is validated against this
740 Workspace when it is attached, so a key-policy problem is reported as an error
741 on this request. This field is write-once: once a key is attached to a Workspace
742 it cannot be detached or replaced. To rotate key material, rotate the underlying
743 key on your cloud KMS; the `external_key_id` stays the same.
720744
721745 - `name: string`
722746
from line 750
726750
727751 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
728752
753 - `user_profile_id: string or null`
754
755 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
756
729757### Example
730758
731759```bash
from line 767
739767 "tags": {
740768 "env": "prod",
741769 "team": "platform"
742 }
770 },
771 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
743772 }'
744773```
745774
from line 792
763792 "env": "prod",
764793 "team": "platform"
765794 },
766 "type": "workspace"
795 "type": "workspace",
796 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
767797}
768798```
769799
from line 839
809839
810840 - `compartment_id: string`
811841
812 Identifier for this Workspace's encryption compartment. When you configure a
813 customer-managed encryption key (CMEK) on AWS, reference this value in your
814 KMS key-policy condition so the key is scoped to this compartment. On GCP and
815 Azure, Anthropic enforces the compartment binding automatically; you do not
816 need to reference this value in your key configuration. See the CMEK
817 integration guide for the required key configuration; unless your organization
818 is on Claude Platform on AWS, it includes a separate value used during key
819 validation. On Claude Platform on AWS there is no separate validation value:
820 the key is validated against this Workspace's own value when it is attached, so
821 if your key policy uses the compartment condition, add this value to it before
822 attaching the key.
842 Identifier for this Workspace's encryption compartment. When you configure an
843 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
844 profile, reference this value in your KMS key-policy condition so the key is
845 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
846 binding automatically; you do not need to reference this value in your key
847 configuration. See the CMEK integration guide for the required key
848 configuration; unless your organization is on Claude Platform on AWS, it
849 includes a separate value used during key validation. On Claude Platform on AWS
850 there is no separate validation value: your organization's own key is validated
851 against this Workspace's own value when it is attached, so if its key policy
852 uses the compartment condition, add this value to it before attaching the key.
823853
824854 - `created_at: string`
825855
from line 895
865895 Workspace. Setting this field requires CMEK to be enabled for your
866896 organization. When set, data stored for this Workspace is encrypted with the
867897 referenced key. Create key configurations with the External Keys API. On
868 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
869 single-Region key in the same AWS account and Region as the Workspace. On that
870 platform the key is validated against this Workspace when it is attached, so a
871 key-policy problem is reported as an error on this request. This field is write-once:
872 once a key is attached to a Workspace it cannot be detached or replaced. To
873 rotate key material, rotate the underlying key on your cloud KMS; the
874 `external_key_id` stays the same.
898 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
899 organization's own key must be a single-Region key in the same AWS account and
900 Region as the Workspace. On that platform the key is validated against this
901 Workspace when it is attached, so a key-policy problem is reported as an error
902 on this request. This field is write-once: once a key is attached to a Workspace
903 it cannot be detached or replaced. To rotate key material, rotate the underlying
904 key on your cloud KMS; the `external_key_id` stays the same.
875905
876906 - `name: string`
877907
from line 911
881911
882912 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
883913
914 - `user_profile_id: string or null`
915
916 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
917
884918### Example
885919
886920```bash
from line 944
910944 "env": "prod",
911945 "team": "platform"
912946 },
913 "type": "workspace"
947 "type": "workspace",
948 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
914949}
915950```
916951
from line 1075
10401075
10411076 - `compartment_id: string`
10421077
1043 Identifier for this Workspace's encryption compartment. When you configure a
1044 customer-managed encryption key (CMEK) on AWS, reference this value in your
1045 KMS key-policy condition so the key is scoped to this compartment. On GCP and
1046 Azure, Anthropic enforces the compartment binding automatically; you do not
1047 need to reference this value in your key configuration. See the CMEK
1048 integration guide for the required key configuration; unless your organization
1049 is on Claude Platform on AWS, it includes a separate value used during key
1050 validation. On Claude Platform on AWS there is no separate validation value:
1051 the key is validated against this Workspace's own value when it is attached, so
1052 if your key policy uses the compartment condition, add this value to it before
1053 attaching the key.
1078 Identifier for this Workspace's encryption compartment. When you configure an
1079 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
1080 profile, reference this value in your KMS key-policy condition so the key is
1081 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
1082 binding automatically; you do not need to reference this value in your key
1083 configuration. See the CMEK integration guide for the required key
1084 configuration; unless your organization is on Claude Platform on AWS, it
1085 includes a separate value used during key validation. On Claude Platform on AWS
1086 there is no separate validation value: your organization's own key is validated
1087 against this Workspace's own value when it is attached, so if its key policy
1088 uses the compartment condition, add this value to it before attaching the key.
10541089
10551090 - `created_at: string`
10561091
from line 1131
10961131 Workspace. Setting this field requires CMEK to be enabled for your
10971132 organization. When set, data stored for this Workspace is encrypted with the
10981133 referenced key. Create key configurations with the External Keys API. On
1099 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
1100 single-Region key in the same AWS account and Region as the Workspace. On that
1101 platform the key is validated against this Workspace when it is attached, so a
1102 key-policy problem is reported as an error on this request. This field is write-once:
1103 once a key is attached to a Workspace it cannot be detached or replaced. To
1104 rotate key material, rotate the underlying key on your cloud KMS; the
1105 `external_key_id` stays the same.
1134 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
1135 organization's own key must be a single-Region key in the same AWS account and
1136 Region as the Workspace. On that platform the key is validated against this
1137 Workspace when it is attached, so a key-policy problem is reported as an error
1138 on this request. This field is write-once: once a key is attached to a Workspace
1139 it cannot be detached or replaced. To rotate key material, rotate the underlying
1140 key on your cloud KMS; the `external_key_id` stays the same.
11061141
11071142 - `name: string`
11081143
from line 1147
11121147
11131148 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
11141149
1150 - `user_profile_id: string or null`
1151
1152 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
1153
11151154### Workspace Member
11161155
11171156- `WorkspaceMember object`
from line 1806
17671806 "data": [
17681807 {
17691808 "type": "workspace_member",
1770 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
1809 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
17711810 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
17721811 "workspace_role": "workspace_admin"
17731812 }
from line 1897
18581897 -H 'anthropic-version: 2026-10-21' \
18591898 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \
18601899 -d '{
1861 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
1900 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
18621901 "workspace_role": "workspace_admin"
18631902 }'
18641903```
from line 1907
18681907```json
18691908{
18701909 "type": "workspace_member",
1871 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
1910 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
18721911 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
18731912 "workspace_role": "workspace_admin"
18741913}
from line 1984
19451984```json
19461985{
19471986 "type": "workspace_member",
1948 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
1987 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
19491988 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
19501989 "workspace_role": "workspace_admin"
19511990}
from line 2081
20422081```json
20432082{
20442083 "type": "workspace_member",
2045 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
2084 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
20462085 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
20472086 "workspace_role": "workspace_admin"
20482087}
from line 2143
21042143```json
21052144{
21062145 "type": "workspace_member_deleted",
2107 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
2146 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
21082147 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
21092148}
21102149```
api/organization/workspaces/archive Changed · +24 / -19 lines
from line 45
4545
4646 - `compartment_id: string`
4747
48 Identifier for this Workspace's encryption compartment. When you configure a
49 customer-managed encryption key (CMEK) on AWS, reference this value in your
50 KMS key-policy condition so the key is scoped to this compartment. On GCP and
51 Azure, Anthropic enforces the compartment binding automatically; you do not
52 need to reference this value in your key configuration. See the CMEK
53 integration guide for the required key configuration; unless your organization
54 is on Claude Platform on AWS, it includes a separate value used during key
55 validation. On Claude Platform on AWS there is no separate validation value:
56 the key is validated against this Workspace's own value when it is attached, so
57 if your key policy uses the compartment condition, add this value to it before
58 attaching the key.
48 Identifier for this Workspace's encryption compartment. When you configure an
49 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
50 profile, reference this value in your KMS key-policy condition so the key is
51 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
52 binding automatically; you do not need to reference this value in your key
53 configuration. See the CMEK integration guide for the required key
54 configuration; unless your organization is on Claude Platform on AWS, it
55 includes a separate value used during key validation. On Claude Platform on AWS
56 there is no separate validation value: your organization's own key is validated
57 against this Workspace's own value when it is attached, so if its key policy
58 uses the compartment condition, add this value to it before attaching the key.
5959
6060 - `created_at: string`
6161
from line 101
101101 Workspace. Setting this field requires CMEK to be enabled for your
102102 organization. When set, data stored for this Workspace is encrypted with the
103103 referenced key. Create key configurations with the External Keys API. On
104 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
105 single-Region key in the same AWS account and Region as the Workspace. On that
106 platform the key is validated against this Workspace when it is attached, so a
107 key-policy problem is reported as an error on this request. This field is write-once:
108 once a key is attached to a Workspace it cannot be detached or replaced. To
109 rotate key material, rotate the underlying key on your cloud KMS; the
110 `external_key_id` stays the same.
104 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
105 organization's own key must be a single-Region key in the same AWS account and
106 Region as the Workspace. On that platform the key is validated against this
107 Workspace when it is attached, so a key-policy problem is reported as an error
108 on this request. This field is write-once: once a key is attached to a Workspace
109 it cannot be detached or replaced. To rotate key material, rotate the underlying
110 key on your cloud KMS; the `external_key_id` stays the same.
111111
112112 - `name: string`
113113
from line 117
117117
118118 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
119119
120 - `user_profile_id: string or null`
121
122 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
123
120124## Example
121125
122126```bash
from line 150
146150 "env": "prod",
147151 "team": "platform"
148152 },
149 "type": "workspace"
153 "type": "workspace",
154 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
150155}
151156```
152157
api/organization/workspaces/create Changed · +37 / -27 lines
from line 65
6565 Workspace. Setting this field requires CMEK to be enabled for your
6666 organization. When set, data stored for this Workspace is encrypted with the
6767 referenced key. Create key configurations with the External Keys API. On
68 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
69 single-Region key in the same AWS account and Region as the Workspace. On that
70 platform the key is validated against this Workspace when it is attached, so a
71 key-policy problem is reported as an error on this request. This field is write-once:
72 once a key is attached to a Workspace it cannot be detached or replaced. To
73 rotate key material, rotate the underlying key on your cloud KMS; the
74 `external_key_id` stays the same.
68 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
69 organization's own key must be a single-Region key in the same AWS account and
70 Region as the Workspace. On that platform the key is validated against this
71 Workspace when it is attached, so a key-policy problem is reported as an error
72 on this request. This field is write-once: once a key is attached to a Workspace
73 it cannot be detached or replaced. To rotate key material, rotate the underlying
74 key on your cloud KMS; the `external_key_id` stays the same.
7575
7676- `tags: optional map[string] or null`
7777
7878 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
7979
80- `user_profile_id: optional string or null`
81
82 ID of a user profile to attach to the Workspace. Every inference request through the Workspace must then name this user profile; the API rejects a request that names none or a different one. The user profile can't be replaced or removed later; only deleting the user profile clears it.
83
8084## Returns
8185
8286- `Workspace object`
from line 105
101105
102106 - `compartment_id: string`
103107
104 Identifier for this Workspace's encryption compartment. When you configure a
105 customer-managed encryption key (CMEK) on AWS, reference this value in your
106 KMS key-policy condition so the key is scoped to this compartment. On GCP and
107 Azure, Anthropic enforces the compartment binding automatically; you do not
108 need to reference this value in your key configuration. See the CMEK
109 integration guide for the required key configuration; unless your organization
110 is on Claude Platform on AWS, it includes a separate value used during key
111 validation. On Claude Platform on AWS there is no separate validation value:
112 the key is validated against this Workspace's own value when it is attached, so
113 if your key policy uses the compartment condition, add this value to it before
114 attaching the key.
108 Identifier for this Workspace's encryption compartment. When you configure an
109 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
110 profile, reference this value in your KMS key-policy condition so the key is
111 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
112 binding automatically; you do not need to reference this value in your key
113 configuration. See the CMEK integration guide for the required key
114 configuration; unless your organization is on Claude Platform on AWS, it
115 includes a separate value used during key validation. On Claude Platform on AWS
116 there is no separate validation value: your organization's own key is validated
117 against this Workspace's own value when it is attached, so if its key policy
118 uses the compartment condition, add this value to it before attaching the key.
115119
116120 - `created_at: string`
117121
from line 161
157161 Workspace. Setting this field requires CMEK to be enabled for your
158162 organization. When set, data stored for this Workspace is encrypted with the
159163 referenced key. Create key configurations with the External Keys API. On
160 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
161 single-Region key in the same AWS account and Region as the Workspace. On that
162 platform the key is validated against this Workspace when it is attached, so a
163 key-policy problem is reported as an error on this request. This field is write-once:
164 once a key is attached to a Workspace it cannot be detached or replaced. To
165 rotate key material, rotate the underlying key on your cloud KMS; the
166 `external_key_id` stays the same.
164 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
165 organization's own key must be a single-Region key in the same AWS account and
166 Region as the Workspace. On that platform the key is validated against this
167 Workspace when it is attached, so a key-policy problem is reported as an error
168 on this request. This field is write-once: once a key is attached to a Workspace
169 it cannot be detached or replaced. To rotate key material, rotate the underlying
170 key on your cloud KMS; the `external_key_id` stays the same.
167171
168172 - `name: string`
169173
from line 177
173177
174178 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
175179
180 - `user_profile_id: string or null`
181
182 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
183
176184## Example
177185
178186```bash
from line 195
187195 "tags": {
188196 "env": "prod",
189197 "team": "platform"
190 }
198 },
199 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
191200 }'
192201```
193202
from line 220
211220 "env": "prod",
212221 "team": "platform"
213222 },
214 "type": "workspace"
223 "type": "workspace",
224 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
215225}
216226```
217227
api/organization/workspaces/list Changed · +24 / -19 lines
from line 71
7171
7272 - `compartment_id: string`
7373
74 Identifier for this Workspace's encryption compartment. When you configure a
75 customer-managed encryption key (CMEK) on AWS, reference this value in your
76 KMS key-policy condition so the key is scoped to this compartment. On GCP and
77 Azure, Anthropic enforces the compartment binding automatically; you do not
78 need to reference this value in your key configuration. See the CMEK
79 integration guide for the required key configuration; unless your organization
80 is on Claude Platform on AWS, it includes a separate value used during key
81 validation. On Claude Platform on AWS there is no separate validation value:
82 the key is validated against this Workspace's own value when it is attached, so
83 if your key policy uses the compartment condition, add this value to it before
84 attaching the key.
74 Identifier for this Workspace's encryption compartment. When you configure an
75 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
76 profile, reference this value in your KMS key-policy condition so the key is
77 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
78 binding automatically; you do not need to reference this value in your key
79 configuration. See the CMEK integration guide for the required key
80 configuration; unless your organization is on Claude Platform on AWS, it
81 includes a separate value used during key validation. On Claude Platform on AWS
82 there is no separate validation value: your organization's own key is validated
83 against this Workspace's own value when it is attached, so if its key policy
84 uses the compartment condition, add this value to it before attaching the key.
8585
8686 - `created_at: string`
8787
from line 127
127127 Workspace. Setting this field requires CMEK to be enabled for your
128128 organization. When set, data stored for this Workspace is encrypted with the
129129 referenced key. Create key configurations with the External Keys API. On
130 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
131 single-Region key in the same AWS account and Region as the Workspace. On that
132 platform the key is validated against this Workspace when it is attached, so a
133 key-policy problem is reported as an error on this request. This field is write-once:
134 once a key is attached to a Workspace it cannot be detached or replaced. To
135 rotate key material, rotate the underlying key on your cloud KMS; the
136 `external_key_id` stays the same.
130 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
131 organization's own key must be a single-Region key in the same AWS account and
132 Region as the Workspace. On that platform the key is validated against this
133 Workspace when it is attached, so a key-policy problem is reported as an error
134 on this request. This field is write-once: once a key is attached to a Workspace
135 it cannot be detached or replaced. To rotate key material, rotate the underlying
136 key on your cloud KMS; the `external_key_id` stays the same.
137137
138138 - `name: string`
139139
from line 143
143143
144144 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
145145
146 - `user_profile_id: string or null`
147
148 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
149
146150- `first_id: string or null`
147151
148152 First ID in the `data` list. Can be used as the `before_id` for the previous page.
from line 189
185189 "env": "prod",
186190 "team": "platform"
187191 },
188 "type": "workspace"
192 "type": "workspace",
193 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
189194 }
190195 ],
191196 "first_id": "first_id",
api/organization/workspaces/members Changed · +6 / -6 lines
from line 104
104104 "data": [
105105 {
106106 "type": "workspace_member",
107 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
107 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
108108 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
109109 "workspace_role": "workspace_admin"
110110 }
from line 195
195195 -H 'anthropic-version: 2026-10-21' \
196196 -H "Authorization: Bearer $ANTHROPIC_API_KEY" \
197197 -d '{
198 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
198 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
199199 "workspace_role": "workspace_admin"
200200 }'
201201```
from line 205
205205```json
206206{
207207 "type": "workspace_member",
208 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
208 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
209209 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
210210 "workspace_role": "workspace_admin"
211211}
from line 282
282282```json
283283{
284284 "type": "workspace_member",
285 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
285 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
286286 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
287287 "workspace_role": "workspace_admin"
288288}
from line 379
379379```json
380380{
381381 "type": "workspace_member",
382 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
382 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
383383 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
384384 "workspace_role": "workspace_admin"
385385}
from line 441
441441```json
442442{
443443 "type": "workspace_member_deleted",
444 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
444 "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
445445 "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
446446}
447447```
api/organization/workspaces/retrieve Changed · +24 / -19 lines
from line 47
4747
4848 - `compartment_id: string`
4949
50 Identifier for this Workspace's encryption compartment. When you configure a
51 customer-managed encryption key (CMEK) on AWS, reference this value in your
52 KMS key-policy condition so the key is scoped to this compartment. On GCP and
53 Azure, Anthropic enforces the compartment binding automatically; you do not
54 need to reference this value in your key configuration. See the CMEK
55 integration guide for the required key configuration; unless your organization
56 is on Claude Platform on AWS, it includes a separate value used during key
57 validation. On Claude Platform on AWS there is no separate validation value:
58 the key is validated against this Workspace's own value when it is attached, so
59 if your key policy uses the compartment condition, add this value to it before
60 attaching the key.
50 Identifier for this Workspace's encryption compartment. When you configure an
51 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
52 profile, reference this value in your KMS key-policy condition so the key is
53 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
54 binding automatically; you do not need to reference this value in your key
55 configuration. See the CMEK integration guide for the required key
56 configuration; unless your organization is on Claude Platform on AWS, it
57 includes a separate value used during key validation. On Claude Platform on AWS
58 there is no separate validation value: your organization's own key is validated
59 against this Workspace's own value when it is attached, so if its key policy
60 uses the compartment condition, add this value to it before attaching the key.
6161
6262 - `created_at: string`
6363
from line 103
103103 Workspace. Setting this field requires CMEK to be enabled for your
104104 organization. When set, data stored for this Workspace is encrypted with the
105105 referenced key. Create key configurations with the External Keys API. On
106 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
107 single-Region key in the same AWS account and Region as the Workspace. On that
108 platform the key is validated against this Workspace when it is attached, so a
109 key-policy problem is reported as an error on this request. This field is write-once:
110 once a key is attached to a Workspace it cannot be detached or replaced. To
111 rotate key material, rotate the underlying key on your cloud KMS; the
112 `external_key_id` stays the same.
106 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
107 organization's own key must be a single-Region key in the same AWS account and
108 Region as the Workspace. On that platform the key is validated against this
109 Workspace when it is attached, so a key-policy problem is reported as an error
110 on this request. This field is write-once: once a key is attached to a Workspace
111 it cannot be detached or replaced. To rotate key material, rotate the underlying
112 key on your cloud KMS; the `external_key_id` stays the same.
113113
114114 - `name: string`
115115
from line 119
119119
120120 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
121121
122 - `user_profile_id: string or null`
123
124 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
125
122126## Example
123127
124128```bash
from line 151
147151 "env": "prod",
148152 "team": "platform"
149153 },
150 "type": "workspace"
154 "type": "workspace",
155 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
151156}
152157```
153158
api/organization/workspaces/update Changed · +37 / -27 lines
from line 59
5959 Workspace. Setting this field requires CMEK to be enabled for your
6060 organization. When set, data stored for this Workspace is encrypted with the
6161 referenced key. Create key configurations with the External Keys API. On
62 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
63 single-Region key in the same AWS account and Region as the Workspace. On that
64 platform the key is validated against this Workspace when it is attached, so a
65 key-policy problem is reported as an error on this request. This field is write-once:
66 once a key is attached to a Workspace it cannot be detached or replaced. To
67 rotate key material, rotate the underlying key on your cloud KMS; the
68 `external_key_id` stays the same.
62 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
63 organization's own key must be a single-Region key in the same AWS account and
64 Region as the Workspace. On that platform the key is validated against this
65 Workspace when it is attached, so a key-policy problem is reported as an error
66 on this request. This field is write-once: once a key is attached to a Workspace
67 it cannot be detached or replaced. To rotate key material, rotate the underlying
68 key on your cloud KMS; the `external_key_id` stays the same.
6969
7070- `name: optional string`
7171
from line 77
7777
7878 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
7979
80- `user_profile_id: optional string`
81
82 ID of a user profile to attach to the Workspace. Every inference request through the Workspace must then name this user profile; the API rejects a request that names none or a different one. Once set, it can't be replaced or removed (sending the same ID again changes nothing); only deleting the user profile clears it. The default Workspace can't have a user profile.
83
8084## Returns
8185
8286- `Workspace object`
from line 105
101105
102106 - `compartment_id: string`
103107
104 Identifier for this Workspace's encryption compartment. When you configure a
105 customer-managed encryption key (CMEK) on AWS, reference this value in your
106 KMS key-policy condition so the key is scoped to this compartment. On GCP and
107 Azure, Anthropic enforces the compartment binding automatically; you do not
108 need to reference this value in your key configuration. See the CMEK
109 integration guide for the required key configuration; unless your organization
110 is on Claude Platform on AWS, it includes a separate value used during key
111 validation. On Claude Platform on AWS there is no separate validation value:
112 the key is validated against this Workspace's own value when it is attached, so
113 if your key policy uses the compartment condition, add this value to it before
114 attaching the key.
108 Identifier for this Workspace's encryption compartment. When you configure an
109 AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
110 profile, reference this value in your KMS key-policy condition so the key is
111 scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
112 binding automatically; you do not need to reference this value in your key
113 configuration. See the CMEK integration guide for the required key
114 configuration; unless your organization is on Claude Platform on AWS, it
115 includes a separate value used during key validation. On Claude Platform on AWS
116 there is no separate validation value: your organization's own key is validated
117 against this Workspace's own value when it is attached, so if its key policy
118 uses the compartment condition, add this value to it before attaching the key.
115119
116120 - `created_at: string`
117121
from line 161
157161 Workspace. Setting this field requires CMEK to be enabled for your
158162 organization. When set, data stored for this Workspace is encrypted with the
159163 referenced key. Create key configurations with the External Keys API. On
160 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
161 single-Region key in the same AWS account and Region as the Workspace. On that
162 platform the key is validated against this Workspace when it is attached, so a
163 key-policy problem is reported as an error on this request. This field is write-once:
164 once a key is attached to a Workspace it cannot be detached or replaced. To
165 rotate key material, rotate the underlying key on your cloud KMS; the
166 `external_key_id` stays the same.
164 Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
165 organization's own key must be a single-Region key in the same AWS account and
166 Region as the Workspace. On that platform the key is validated against this
167 Workspace when it is attached, so a key-policy problem is reported as an error
168 on this request. This field is write-once: once a key is attached to a Workspace
169 it cannot be detached or replaced. To rotate key material, rotate the underlying
170 key on your cloud KMS; the `external_key_id` stays the same.
167171
168172 - `name: string`
169173
from line 177
173177
174178 User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.
175179
180 - `user_profile_id: string or null`
181
182 ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.
183
176184## Example
177185
178186```bash
from line 194
186194 "tags": {
187195 "env": "prod",
188196 "team": "platform"
189 }
197 },
198 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
190199 }'
191200```
192201
from line 219
210219 "env": "prod",
211220 "team": "platform"
212221 },
213 "type": "workspace"
222 "type": "workspace",
223 "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
214224}
215225```
216226
api/rate-limits Changed · +30 / -30 lines
from line 128
128128
129129OTPM rate limits are evaluated in real time as output tokens are produced, counting only the actual tokens generated. The `max_tokens` parameter does not factor into OTPM rate limit calculations, so there is no rate limit downside to setting a higher `max_tokens` value.
130130
131Each row in the following tables has its own RPM, ITPM, and OTPM limits. Some rows cover several models that share one limit; see the notes under the tables. You can check your current rate limits and behavior on the [Rate limits](https://platform.claude.com/usage/limits) page in the Claude Console, or read the configured limits programmatically with the [Rate Limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api).
131Each row in the following tables has its own RPM, ITPM, and OTPM limits. Some rows cover several models that share one limit; see the notes under the tables. You can check your current rate limits and behavior on the [Rate limits](https://platform.claude.com/usage/limits) page in the Claude Console, or read the configured limits and set workspace limits programmatically with the [Rate Limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api).
132132
133133<Note>
134134 Rate limits are currently shared across all `inference_geo` values. Requests with `inference_geo: "us"` and `inference_geo: "global"` draw from the same rate limit pool.
from line 138
138138 <Tab title="Start tier">
139139 | Model | Maximum requests per minute (RPM) | Maximum input tokens per minute (ITPM) | Maximum output tokens per minute (OTPM) |
140140 | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------- | --------------------------------------- |
141 | Claude Fable 5.x1 | 1,000 | 500,000 | 100,000 |
142 | Claude Opus 5.5 | 1,000 | 2,000,000 | 400,000 |
141 | Claude Fable 5.x<sup>1</sup> | 4,000 | 500,000 | 100,000 |
142 | Claude Opus 5.5 | 4,000 | 2,000,000 | 400,000 |
143143 | Claude Opus 5 | 1,000 | 2,000,000 | 400,000 |
144 | Claude Opus 4.x2 | 1,000 | 2,000,000 | 400,000 |
145 | Claude Sonnet 5.5 | 1,000 | 2,000,000 | 400,000 |
144 | Claude Opus 4.x<sup>2</sup> | 1,000 | 2,000,000 | 400,000 |
145 | Claude Sonnet 5.5 | 4,000 | 2,000,000 | 400,000 |
146146 | Claude Sonnet 5 | 1,000 | 2,000,000 | 400,000 |
147 | Claude Sonnet 4.x3 | 1,000 | 2,000,000 | 400,000 |
148 | Claude Haiku 5.5 | 1,000 | 2,000,000 | 400,000 |
147 | Claude Sonnet 4.x<sup>3</sup> | 1,000 | 2,000,000 | 400,000 |
148 | Claude Haiku 5.5 | 4,000 | 2,000,000 | 400,000 |
149149 | Claude Haiku 4.5 | 1,000 | 2,000,000 | 400,000 |
150 | Claude Haiku 3.5 ([retired, except on Claude Models on Google Cloud (Google managed)](https://platform.claude.com/docs/en/about-claude/model-deprecations)) | 1,000 | 100,0004 | 20,000 |
150 | Claude Haiku 3.5 ([retired, except on Claude Models on Google Cloud (Google managed)](https://platform.claude.com/docs/en/about-claude/model-deprecations)) | 1,000 | 100,000<sup>4</sup> | 20,000 |
151151 </Tab>
152152
153153 <Tab title="Build tier">
154154 | Model | Maximum requests per minute (RPM) | Maximum input tokens per minute (ITPM) | Maximum output tokens per minute (OTPM) |
155155 | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------- | --------------------------------------- |
156 | Claude Fable 5.x1 | 2,000 | 1,500,000 | 300,000 |
157 | Claude Opus 5.5 | 5,000 | 5,000,000 | 1,000,000 |
156 | Claude Fable 5.x<sup>1</sup> | 10,000 | 1,500,000 | 300,000 |
157 | Claude Opus 5.5 | 10,000 | 5,000,000 | 1,000,000 |
158158 | Claude Opus 5 | 5,000 | 5,000,000 | 1,000,000 |
159 | Claude Opus 4.x2 | 5,000 | 5,000,000 | 1,000,000 |
160 | Claude Sonnet 5.5 | 5,000 | 5,000,000 | 1,000,000 |
159 | Claude Opus 4.x<sup>2</sup> | 5,000 | 5,000,000 | 1,000,000 |
160 | Claude Sonnet 5.5 | 10,000 | 5,000,000 | 1,000,000 |
161161 | Claude Sonnet 5 | 5,000 | 5,000,000 | 1,000,000 |
162 | Claude Sonnet 4.x3 | 5,000 | 5,000,000 | 1,000,000 |
163 | Claude Haiku 5.5 | 5,000 | 5,000,000 | 1,000,000 |
162 | Claude Sonnet 4.x<sup>3</sup> | 5,000 | 5,000,000 | 1,000,000 |
163 | Claude Haiku 5.5 | 10,000 | 5,000,000 | 1,000,000 |
164164 | Claude Haiku 4.5 | 5,000 | 5,000,000 | 1,000,000 |
165 | Claude Haiku 3.5 ([retired, except on Claude Models on Google Cloud (Google managed)](https://platform.claude.com/docs/en/about-claude/model-deprecations)) | 2,000 | 200,0004 | 40,000 |
165 | Claude Haiku 3.5 ([retired, except on Claude Models on Google Cloud (Google managed)](https://platform.claude.com/docs/en/about-claude/model-deprecations)) | 2,000 | 200,000<sup>4</sup> | 40,000 |
166166 </Tab>
167167
168168 <Tab title="Scale tier">
169169 | Model | Maximum requests per minute (RPM) | Maximum input tokens per minute (ITPM) | Maximum output tokens per minute (OTPM) |
170170 | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------- | --------------------------------------- |
171 | Claude Fable 5.x1 | 4,000 | 4,000,000 | 800,000 |
172 | Claude Opus 5.5 | 10,000 | 10,000,000 | 2,000,000 |
171 | Claude Fable 5.x<sup>1</sup> | 13,000 | 4,000,000 | 800,000 |
172 | Claude Opus 5.5 | 13,000 | 10,000,000 | 2,000,000 |
173173 | Claude Opus 5 | 10,000 | 10,000,000 | 2,000,000 |
174 | Claude Opus 4.x2 | 10,000 | 10,000,000 | 2,000,000 |
175 | Claude Sonnet 5.5 | 10,000 | 10,000,000 | 2,000,000 |
174 | Claude Opus 4.x<sup>2</sup> | 10,000 | 10,000,000 | 2,000,000 |
175 | Claude Sonnet 5.5 | 13,000 | 10,000,000 | 2,000,000 |
176176 | Claude Sonnet 5 | 10,000 | 10,000,000 | 2,000,000 |
177 | Claude Sonnet 4.x3 | 10,000 | 10,000,000 | 2,000,000 |
178 | Claude Haiku 5.5 | 10,000 | 10,000,000 | 2,000,000 |
177 | Claude Sonnet 4.x<sup>3</sup> | 10,000 | 10,000,000 | 2,000,000 |
178 | Claude Haiku 5.5 | 13,000 | 10,000,000 | 2,000,000 |
179179 | Claude Haiku 4.5 | 10,000 | 10,000,000 | 2,000,000 |
180 | Claude Haiku 3.5 ([retired, except on Claude Models on Google Cloud (Google managed)](https://platform.claude.com/docs/en/about-claude/model-deprecations)) | 4,000 | 400,0004 | 80,000 |
180 | Claude Haiku 3.5 ([retired, except on Claude Models on Google Cloud (Google managed)](https://platform.claude.com/docs/en/about-claude/model-deprecations)) | 4,000 | 400,000<sup>4</sup> | 80,000 |
181181 </Tab>
182182
183183 <Tab title="Custom tier">
from line 185
185185 </Tab>
186186</Tabs>
187187
188*1 Fable rate limit is a total limit that applies to combined traffic across Claude Fable 5.1 and Claude Fable 5. Claude Mythos 5.1 and Claude Mythos 5 share a separate combined limit on the same terms.*
188*<sup>1 Fable rate limit is a total limit that applies to combined traffic across Claude Fable 5.1 and Claude Fable 5. Claude Mythos 5.1 and Claude Mythos 5 share a separate combined limit on the same terms.</sup>*
189189
190*2 Opus rate limit is a total limit that applies to combined traffic across Claude Opus 4.8, Opus 4.7, Opus 4.6, and Opus 4.5. Claude Opus 5.5 and Claude Opus 5 each have a separate rate limit and are not part of this combined bucket.*
190*<sup>2 Opus rate limit is a total limit that applies to combined traffic across Claude Opus 4.8, Opus 4.7, Opus 4.6, and Opus 4.5. Claude Opus 5.5 and Claude Opus 5 each have a separate rate limit and are not part of this combined bucket.</sup>*
191191
192*3 Sonnet 4.x rate limit is a total limit that applies to combined traffic across Sonnet 4.6 and Sonnet 4.5 ([deprecated](https://platform.claude.com/docs/en/about-claude/model-deprecations)). Claude Sonnet 5.5 and Claude Sonnet 5 each have a separate rate limit and are not part of this combined bucket.*
192*<sup>3 Sonnet 4.x rate limit is a total limit that applies to combined traffic across Sonnet 4.6 and Sonnet 4.5 ([deprecated](https://platform.claude.com/docs/en/about-claude/model-deprecations)). Claude Sonnet 5.5 and Claude Sonnet 5 each have a separate rate limit and are not part of this combined bucket.</sup>*
193193
194*4 Limit counts `cache_read_input_tokens` toward ITPM usage.*
194*<sup>4 Limit counts `cache_read_input_tokens` toward ITPM usage.</sup>*
195195
196196### Message Batches API
197197
from line 280
280280* Workspace limits are set for each limiter type (such as requests per minute, input tokens per minute, or output tokens per minute).
281281* Organization-wide limits always apply, even if Workspace limits add up to more.
282282
283To read your current organization and workspace rate limits programmatically, use the [Rate Limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api).
283To read your current organization and workspace rate limits or set workspace rate limits programmatically, use the [Rate Limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api).
284284
285285## Response headers
286286
build-with-claude/citations Changed · +62 / -3 lines
## Feature compatibility ### Get structured data with citations ### Using prompt caching with citations ### Feature compatibility #### Using prompt caching with citations
from line 398
398398* However, the citations feature is very efficient with output tokens. Internally, the model outputs citations in a standardized format, and those citations are then parsed into cited text and document location indices. The `cited_text` field is provided for convenience and does not count toward output tokens.
399399* When passed back in subsequent conversation turns, `cited_text` is also not counted toward input tokens.
400400
401### Feature compatibility
401## Feature compatibility
402402
403403Citations work in conjunction with other API features including [prompt caching](https://platform.claude.com/docs/en/build-with-claude/prompt-caching), [token counting](https://platform.claude.com/docs/en/build-with-claude/token-counting), and [batch processing](https://platform.claude.com/docs/en/build-with-claude/batch-processing).
404404
from line 410
410410 This is because citations require interleaving citation blocks with text output, which is incompatible with the strict JSON schema constraints of structured outputs.
411411</Warning>
412412
413#### Using prompt caching with citations
413### Get structured data with citations
414414
415To get a citation for each extracted value, prompt Claude to answer with one line per field. Then parse the lines into structured data in your code.
416
417Avoid user or system prompts that ask for only JSON, such as “Return only a JSON object, no other text.” A request with such a prompt succeeds, but the response might contain few or no citations.
418
419The following prompt asks for two fields from the plain text document in the example at the top of this page. Send it in place of that example’s question:
420
421```text wrap
422Extract these fields from the document: grass_color, sky_color.
423Answer with one line per field in the form "field: value", and cite the document for each line. After the colon, write only the value, with no explanation or quotation.
424```
425
426In the following response, each value has its own citations:
427
428```json
429{
430 "content": [
431 { "type": "text", "text": "grass_color: " },
432 {
433 "type": "text",
434 "text": "green",
435 "citations": [
436 {
437 "type": "char_location",
438 "cited_text": "The grass is green. ",
439 "document_index": 0,
440 "document_title": "My Document",
441 "start_char_index": 0,
442 "end_char_index": 20
443 }
444 ]
445 },
446 { "type": "text", "text": "\nsky_color: " },
447 {
448 "type": "text",
449 "text": "blue",
450 "citations": [
451 {
452 "type": "char_location",
453 "cited_text": "The sky is blue.",
454 "document_index": 0,
455 "document_title": "My Document",
456 "start_char_index": 20,
457 "end_char_index": 36
458 }
459 ]
460 }
461 ]
462}
463```
464
465To parse the response, follow these steps:
466
4671. Read the `text` blocks in order, and add each block’s text to the current line. Start a new line at each newline character.
4682. Attach each block’s `citations` to every line that contains part of its text. A cited block can hold only a value, as in this example, or a whole line.
4693. Skip lines that have no colon. Split each remaining line at its first colon into a field name and a value, and trim spaces from both. Skip lines whose name isn’t one of your fields, such as a closing note.
4704. Check that each field has a value and at least one citation. The API doesn’t guarantee either.
471
472### Using prompt caching with citations
473
415474Citations and prompt caching can be used together effectively.
416475
417476The citation blocks generated in responses cannot be cached directly, but the source documents they reference can be cached. To optimize performance, apply `cache_control` to your top-level document content blocks.
from line 2243
21842243 "citations": [
21852244 {
21862245 "type": "char_location",
2187 "cited_text": "The grass is green.",
2246 "cited_text": "The grass is green. ",
21882247 "document_index": 0,
21892248 "document_title": "Example Document",
21902249 "start_char_index": 0,
build-with-claude/claude-models-on-google-cloud/anthropic-managed Changed · +10 / -6 lines
## Support
from line 406
406406
407407The client for Claude Models on Google Cloud (Anthropic managed) takes the settings in the following table. A value you pass when you create the client wins over the environment variable. To set the project and workspace ID explicitly, pass `project` (go: `Project`; java: `.project()`; csharp: `GoogleCloudClientOptions.Project`; cli: `--google-cloud-project`) and `workspace_id` (typescript, php: `workspaceId`; go: `WorkspaceID`; java: `.workspaceId()`; csharp: `GoogleCloudClientOptions.WorkspaceId`; cli: `--google-cloud-workspace-id`).
408408
409| Setting | Environment variable | If unset |
410| ------------ | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
411| Project ID | `ANTHROPIC_GOOGLE_CLOUD_PROJECT`, then `GOOGLE_CLOUD_PROJECT` | The project that Application Default Credentials reports, when the credential type carries one |
412| Workspace ID | `ANTHROPIC_GOOGLE_CLOUD_WORKSPACE_ID` | The client raises an error unless you set the base URL. [Organization-level routes](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed#iam-roles) don’t need a workspace ID. |
413| Location | `ANTHROPIC_GOOGLE_CLOUD_LOCATION` | `global` |
414| Base URL | `ANTHROPIC_GOOGLE_CLOUD_BASE_URL` | Derived from the project, location, and workspace ID |
409| Setting | Environment variable | If unset |
410| ------------ | ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
411| Project ID | `ANTHROPIC_GOOGLE_CLOUD_PROJECT`, then `GOOGLE_CLOUD_PROJECT` | The project that Application Default Credentials reports, when the credential type carries one |
412| Workspace ID | `ANTHROPIC_GOOGLE_CLOUD_WORKSPACE_ID` | The client raises an error unless you set the base URL. [Organization-level routes](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed#iam-roles) and [user profile](https://platform.claude.com/docs/en/manage-claude/user-profiles) routes don’t need a workspace ID. |
413| Location | `ANTHROPIC_GOOGLE_CLOUD_LOCATION` | `global` |
414| Base URL | `ANTHROPIC_GOOGLE_CLOUD_BASE_URL` | Derived from the project, location, and workspace ID |
415415
416416Leave the location at `global`. The location is separate from where inference runs, so for US-only inference, set `inference_geo: "us"` on each request, as described in [Data residency](https://platform.claude.com/docs/en/manage-claude/data-residency#inference-geo).
417417
from line 825
825825 Run the request in [Making requests](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed#making-requests) to check that your setup works. Then run your own code. If a call fails with a permission error, see [Troubleshooting account setup](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed#troubleshooting-account-setup). Before you move production traffic, check the [rate limits for Claude Models on Google Cloud (Anthropic managed)](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed#rate-limits).
826826 </Step>
827827</Steps>
828
829## Support
830
831[Google Cloud Support](https://cloud.google.com/support) handles your Google Cloud account, access, and billing. [Anthropic Support](https://support.claude.com/en/articles/9015913-how-to-get-support) handles Claude itself, including models, API errors, and rate limits. To request higher rate limits, see [Rate limits](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed#rate-limits).
828832
829833## Next steps
830834
build-with-claude/claude-on-amazon-bedrock-legacy Changed · +1 / -7 lines
from line 749
749749
750750### PDF support on Bedrock
751751
752PDF support is available on Bedrock through both the Converse API and InvokeModel API. For detailed information about PDF processing capabilities and limitations, see [Amazon Bedrock PDF support](https://platform.claude.com/docs/en/build-with-claude/pdf-support#amazon-bedrock-pdf-support).
753
754**Important considerations for Converse API users:**
755
756* Visual PDF analysis (charts, images, layouts) requires citations to be enabled
757* Without citations, only basic text extraction is available
758* For full control without forced citations, use the InvokeModel API
752[PDF support](https://platform.claude.com/docs/en/build-with-claude/pdf-support) is available on Bedrock through both the Converse API and the InvokeModel API.
759753
760754### Mid-conversation system messages on Bedrock
761755
build-with-claude/fast-mode Changed · +5 / -1 lines
from line 688
688688
689689Fast mode is available only on the following models. If you were using fast mode on an earlier model, [migrate to a model that supports fast mode](https://platform.claude.com/docs/en/models/opus-5-5/migration-guide).
690690
691To access fast mode on Claude Opus 5 or Claude Opus 4.8, contact your account manager or [join the waitlist](https://claude.com/fast-mode).
691To access fast mode on Claude Opus 5, contact your account manager or [join the waitlist](https://claude.com/fast-mode).
692
693<Warning>
694 Fast mode on Claude Opus 4.8 is deprecated and will be removed on November 30, 2026. After removal, requests to `claude-opus-4-8` with `speed: "fast"` will return an error. To continue using fast mode, migrate to Claude Opus 5.5. See [Migrating to Claude Opus 5.5 from Claude Opus 4.8](https://platform.claude.com/docs/en/models/opus-5-5/migration-guide#migrating-from-claude-opus-4-8).
695</Warning>
692696
693697#### [Messages API](https://platform.claude.com/docs/en/build-with-claude/working-with-messages)
694698