Home Docs Claude Developer Platform

One capture · api

One read of Claude Developer Platformapi-20261105T170711Z

5 pages moved out of 886 read.

Pages moved 5 significant first

Pages read 886 in this capture

Captured 5 Nov 2026 17:07 UTC

Corpus hash b182d0441ddd corpus-hash

What this read moved

1-5 of 5

manage-claude/ip-allowlist New page · 106 lines, new page

## How it works ## Claude Platform organizations ### Where the allowlist applies ## Claude Enterprise organizations ### Apps that the allowlist covers ### What users can expect ## Limitations ## Turn on the allowlist ### Entry format ## Avoid locking yourself out ### If you are locked out

A whole new page. There's nothing to diff it against, so here is what it says.

---
title: IP allowlisting
url: https://platform.claude.com/docs/en/manage-claude/ip-allowlist
description: Secure your organization by limiting access to specific IP addresses that you trust.
featureMetadata:
  status: beta
---

IP allowlisting protects your organization by only allowing [covered requests](https://platform.claude.com/docs/en/manage-claude/ip-allowlist#where-the-allowlist-applies) to come from specific IP ranges. This means that if an API key is leaked, it is much harder for an attacker to use the key. This can prevent data leaks and reduce the likelihood of being charged for abusive use.

An allowlist limits where a key works, but not for how long. You should also set a short [key expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration), or move to [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation) to stop using static keys. This is safer than allowlisting alone.

<Note>
  IP allowlisting is available in beta under your agreement with Anthropic, such as the [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) and the [Service Specific Terms](https://www.anthropic.com/legal/service-specific-terms). Settings and behavior can change during the beta.
</Note>

## How it works

An organization admin or owner sets up a list of IP ranges in settings. This list of ranges covers your entire organization. For each covered request, Anthropic compares the request’s public IP address with your list, and denies it if it is not allowed.

* **API requests** to [covered endpoints](https://platform.claude.com/docs/en/manage-claude/ip-allowlist#where-the-allowlist-applies) from an address outside the list are rejected. For example, the Messages API returns a 403 `permission_error` with the message `Your IP address isn't in this organization's allowed range.`
* **People** who connect from a disallowed address see a page titled **Your current network can’t access this organization**. Organization admins are also blocked, but you can optionally [give admins a way back in](https://platform.claude.com/docs/en/manage-claude/ip-allowlist#avoid-locking-yourself-out) to avoid lockout, in which case they can access only the allowlist settings.

## Claude Platform organizations

### Where the allowlist applies

* **The Claude Console:** UI access is restricted.
* **The following Claude API endpoints:** [Messages](https://platform.claude.com/docs/en/api/messages), [Message Batches](https://platform.claude.com/docs/en/build-with-claude/batch-processing), [Token Counting](https://platform.claude.com/docs/en/build-with-claude/token-counting), [Models](https://platform.claude.com/docs/en/api/models/list), [Files](https://platform.claude.com/docs/en/build-with-claude/files), and [Skills](https://platform.claude.com/docs/en/build-with-claude/skills-guide), with an API key or a Workload Identity Federation token.
* **The following Claude Managed Agents endpoints:** [Agents](https://platform.claude.com/docs/en/managed-agents/agent-setup), [Sessions](https://platform.claude.com/docs/en/managed-agents/sessions), [Environments](https://platform.claude.com/docs/en/managed-agents/environments), [Vaults](https://platform.claude.com/docs/en/managed-agents/vaults), and [Memory stores](https://platform.claude.com/docs/en/managed-agents/memory), with an API key or a Workload Identity Federation token.
* **The following organization APIs:** The [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api) and the [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api), with a [key that covers only this organization](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#which-key-do-you-need).

See also [Limitations](https://platform.claude.com/docs/en/manage-claude/ip-allowlist#limitations).

## Claude Enterprise organizations

A Claude Enterprise organization has its own IP allowlist, which only allows access to the [apps that it covers](https://platform.claude.com/docs/en/manage-claude/ip-allowlist#apps-that-the-allowlist-covers) from specific IP ranges. This means that if a user’s sign-in is stolen, it is much harder for an attacker to use it. This list covers your entire organization, owners included. Owners and primary owners can set it up. Before you [turn on the allowlist](https://platform.claude.com/docs/en/manage-claude/ip-allowlist#turn-on-the-allowlist), read [Avoid locking yourself out](https://platform.claude.com/docs/en/manage-claude/ip-allowlist#avoid-locking-yourself-out).

### Apps that the allowlist covers

Users outside the list lose access to your organization in:

* Claude in a browser, the desktop apps, and the mobile apps
* [Claude Code](https://code.claude.com/docs/en/overview), when users sign in with their Claude account
* Claude in Chrome, the [Office add-ins](https://claude.com/docs/office-agents/overview), [Cowork](https://claude.com/docs/cowork/overview), and Remote Tools

This includes connectors and artifacts in these apps, except artifacts that a user shared outside the organization. For Claude Science, see [Identity and access in the Claude Science admin controls](https://claude.com/docs/claude-science/admin-controls#identity-and-access).

The allowlist also covers the [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api) and the [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api), with a [key that covers only this organization](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#which-key-do-you-need).

See also [Limitations](https://platform.claude.com/docs/en/manage-claude/ip-allowlist#limitations).

### What users can expect

On the web and in the desktop apps, blocked users see a page titled **Your current network can’t access this organization**. Owners are also blocked, but you can optionally [give owners a way back in](https://platform.claude.com/docs/en/manage-claude/ip-allowlist#avoid-locking-yourself-out) to avoid lockout, in which case they can access only the allowlist settings. In Claude Code, blocked users see a 403 API error with the message `Your IP address isn't in this organization's allowed range.`

* **Other accounts:** Blocked users can still sign in and use other organizations or a personal account.
* **Remote users:** Phones on mobile data, home Wi-Fi, and laptops off the VPN are blocked until they connect through a listed network.
* **Proxies:** Some features connect through `bridge.claudeusercontent.com`: Claude in Chrome, Cowork, Remote Tools, and [work across apps](https://claude.com/docs/office-agents/work-across-apps) in the Office add-ins. If your proxy sends that host out through a different address from `claude.ai` and `api.anthropic.com`, list that address too.

## Limitations

* **Claude Platform:** The allowlist covers requests to the [Claude Managed Agents](https://platform.claude.com/docs/en/managed-agents/overview) endpoints, not the agents themselves. It doesn’t apply to any networking in the Claude Managed Agents runtime. The allowlist doesn’t apply to [Claude in Amazon Bedrock](https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock), [Claude Platform on AWS](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws), [Claude Models on Google Cloud](https://platform.claude.com/docs/en/build-with-claude/claude-models-on-google-cloud/overview), or [Claude in Microsoft Foundry](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry).
* **Claude Enterprise:** Claude Design, Claude in Slack, and Claude Academy aren’t covered. If Claude is working on a task in a chat when a user is blocked, the task can continue for up to 24 hours. The user can’t open or control that chat from outside the list.

## Turn on the allowlist

<Steps>
  <Step title="Turn on the toggle">
    Go to your organization’s settings page:

    * **Claude Platform:** The [Identity and access](https://platform.claude.com/settings/identity) page in the Claude Console
    * **Claude Enterprise:** [claude.ai > Organization settings > Organization and access](https://claude.ai/admin-settings/organization#ip-allowlist)

    Turn on the **IP allowlist** toggle. Nothing changes until you save.
  </Step>

  <Step title="Add your ranges and save">
    Click **Add entry** (Claude Console) or **Add IP range** (claude.ai), enter one or more addresses or ranges, separated by commas, and press Enter. List each network that your servers, CI, and users connect from, including the one you’re connecting from. Anthropic recommends making sure the **Allow admins to access this settings page from any IP address** (Claude Console) or **Allow owners to access this settings page from any IP address** (claude.ai) checkbox is selected to [avoid lockout](https://platform.claude.com/docs/en/manage-claude/ip-allowlist#avoid-locking-yourself-out). Then click **Save** and confirm.
  </Step>

  <Step title="Check your traffic">
    Changes can take up to 15 minutes to apply. Watch your applications for 403 `permission_error` responses, including jobs that run only daily or weekly, and add any address that you missed. In a Claude Enterprise organization, ask users on each network to confirm that they can still open Claude. There, changes can take longer to reach connections that are already open, the Office add-ins, and Remote Tools.
  </Step>
</Steps>

### Entry format

* **Format:** You can allowlist IPv4 or IPv6 addresses. Each entry can be a single address (`203.0.113.5`) or a CIDR range (`203.0.113.0/24`, `2001:db8::/32`) no broader than `/8` for IPv4 or `/32` for IPv6. The list holds up to 1,000 entries.
* **Public addresses only:** List the addresses that your traffic leaves your network from, not private ranges such as `10.0.0.0/8`. If you add a shared proxy address, note that an attacker with a leaked key or a stolen sign-in could potentially use it through the proxy.

## Avoid locking yourself out

When you save, the settings page checks your current address against the list to make sure you aren’t about to lock yourself out. But it does not check your servers, your teammates, or the address you might connect from tomorrow.

* **Make sure to list every network first:** Include data centers, CI systems, offices, VPNs, proxies, and the workers of any [self-hosted sandboxes](https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes), with their public IPv4 and IPv6 addresses. Note that home and mobile addresses can often change without notice.
* **Keep a way back in:** Anthropic recommends selecting the **Allow admins to access this settings page from any IP address** (Claude Console) or **Allow owners to access this settings page from any IP address** (claude.ai) checkbox. Then an admin (an owner in claude.ai) can fix the list from anywhere. The downside is that an attacker who compromises an admin’s or owner’s session could update the allowlist from a remote location. If you [set up the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access) for your organization, its [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) records changes to the allowlist, so you can audit them.

### If you are locked out

In a Claude Enterprise organization, admins can’t change the list, so “admin or owner” in these steps means an owner or primary owner.

1. **Reconnect from a listed network:** Connect to your office network or VPN, and then click **Try again**. If there is no **Try again** button, reload the page.
2. **Ask another admin or owner:** An admin or owner on a listed network can add your address.
3. **Fix the list from where you are:** If you are an admin or owner and the checkbox under [Keep a way back in](https://platform.claude.com/docs/en/manage-claude/ip-allowlist#avoid-locking-yourself-out) is selected, open the Claude Console or Claude in a browser and click **Open IP allowlist**, or go to the [Identity and access](https://platform.claude.com/settings/identity) page ([Organization and access](https://claude.ai/admin-settings/organization#ip-allowlist) in claude.ai). Click **Add it** to add your current address, or turn off the allowlist, and then click **Save** and confirm. Access can take up to 15 minutes to return.
4. **Contact Anthropic:** If no admin or owner can reach the page, ask [Anthropic support](https://support.claude.com) to turn off the allowlist.

manage-claude/user-management Changed · +137 / -9 lines

### Sign a member out everywhere #### What the request ends #### What the request doesn’t end #### Who you can’t sign out #### Responses #### Where the sign-out is recorded ### Respond to a lost or stolen device ### Does signing a member out keep them out?

from line 8

99* List members and look them up by email address

1010* Change a member’s role

11* Remove members

11* Remove members, or sign them out everywhere without removing them (beta)

1212* Send and withdraw invites

1313* Manage your enterprise’s groups and their membership

1414* Read your organization’s custom roles

from line 45

4545

4646This page covers five resources:

4747

48| Resource | Endpoints | Use for |

49| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------- |

50| **Members** | `GET /v1/organizations/users` `GET /v1/organizations/users/{user_id}` `POST /v1/organizations/users/{user_id}` `DELETE /v1/organizations/users/{user_id}` | List the organization’s members or look one up by email; change a member’s role; remove a member. |

51| **Invites** | `POST /v1/organizations/invites` `GET /v1/organizations/invites` `GET /v1/organizations/invites/{invite_id}` `DELETE /v1/organizations/invites/{invite_id}` | Invite a person to the organization, track the invitation’s status, and withdraw it before it is accepted. |

52| **Groups** | `GET /v1/organizations/rbac_groups` `GET /v1/organizations/rbac_groups/{rbac_group_id}` `POST /v1/organizations/rbac_groups` `POST /v1/organizations/rbac_groups/{rbac_group_id}` `DELETE /v1/organizations/rbac_groups/{rbac_group_id}` | Read your enterprise’s groups and the custom roles attached to each; create, rename, and delete groups. |

53| **Group members** | `GET /v1/organizations/rbac_groups/{rbac_group_id}/members` `POST /v1/organizations/rbac_groups/{rbac_group_id}/members` `DELETE /v1/organizations/rbac_groups/{rbac_group_id}/members/{user_id}` | Read a group’s members; add and remove members. |

54| **Custom roles** | `GET /v1/organizations/rbac_roles` `GET /v1/organizations/rbac_roles/{rbac_role_id}` `GET /v1/organizations/rbac_roles/{rbac_role_id}/permissions` | Read your organization’s custom roles and the permissions each role grants. |

48| Resource | Endpoints | Use for |

50| **Members** | `GET /v1/organizations/users` `GET /v1/organizations/users/{user_id}` `POST /v1/organizations/users/{user_id}` `DELETE /v1/organizations/users/{user_id}` `POST /v1/organizations/users/{user_id}/sign_out` (beta) | List the organization’s members or look one up by email; change a member’s role; remove a member; sign a member out everywhere. |

5555

5656Custom roles and their group attachments are managed in [claude.ai organization settings](https://claude.ai/admin-settings); the API reads them but cannot change them.

5757

from line 620

620620}

621621```

622622

623### Sign a member out everywhere

624

625`POST /v1/organizations/users/{user_id}/sign_out` signs a member out of Claude on every browser and device, without removing them from the organization. Use it when a member’s device is lost or stolen, during a security incident, or while you investigate an account before you decide whether to remove the member. Requires the `write:members` scope.

626

627<Note>

628 This endpoint is in **beta** for Claude Enterprise organizations.

629

630 Every request must include the [beta header](https://platform.claude.com/docs/en/api/beta-headers) `anthropic-beta: admin-user-sign-out-2026-10-08`. A request without it returns 400, with a message that names the value.

631

632 If your version of the SDK or the `ant` CLI doesn’t have this endpoint, send the request over HTTP with this header.

633</Note>

634

635The sign-out reaches the person’s whole Claude account, including their sessions in other organizations and on an individual plan. The member keeps their seat and role and can sign in again right away. To keep someone out, [remove them](https://platform.claude.com/docs/en/manage-claude/user-management#remove-a-member) or, if your organization requires single sign-on, disable their account in your identity provider. Disabling stops new sign-ins but leaves them in your member list. If you remove someone and leave their identity provider account active, automatic provisioning can add them back at their next sign-in. If your identity provider manages membership, you can remove the member only there.

636

637Create the key before you need it. See [Create a key for a Claude Enterprise organization](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#create-a-key-for-a-claude-enterprise-organization). A `write:members` key works only in the organization it was created in, so each linked organization needs its own key. That organization’s primary owner creates it. To look members up by email address with the same key, also select the `read:members` scope.

638

639The request has no body. Pass the member’s `id`, which [List members](https://platform.claude.com/docs/en/manage-claude/user-management#list-members) returns:

640

641<CodeGroup>

642 ```bash cURL

643 curl -X POST "https://api.anthropic.com/v1/organizations/users/user_01AbCdEfGhIjKlMnOpQrSt/sign_out" \

644 -H "x-api-key: $ANTHROPIC_API_KEY" \

645 -H "anthropic-version: 2023-06-01" \

646 -H "anthropic-beta: admin-user-sign-out-2026-10-08"

647 ```

648</CodeGroup>

649

650A successful request returns 200 with the member, whose role and other fields are unchanged:

651

652```json

653{

654 "type": "user",

655 "id": "user_01AbCdEfGhIjKlMnOpQrSt",

656 "email": "[email protected]",

657 "name": "Jane Smith",

658 "role": "user",

659 "added_at": "2026-06-12T09:14:03Z"

660}

661```

662

663If you have no key yet, an owner can use the **Sign out everywhere** action on the Members page of [claude.ai organization settings](https://claude.ai/admin-settings) instead. It ends the same sessions, trusted devices, and OAuth tokens, and removes the same push-notification registrations. An owner can’t use it on their own account: they sign out their own sessions from their account settings in claude.ai.

664

665#### What the request ends

666

667The request ends all of the following for the member:

668

669* **Sign-in sessions:** All of them for the person’s account, on every browser and device.

670* **Trusted devices:** Every browser, computer, or phone that the person registered as trusted for sensitive actions. The person must register each device again.

671* **OAuth tokens issued for this organization:** Whichever app holds them, such as Claude Code or a third-party app. Those apps must sign in again. A token almost always stops working at once, and within an hour at most.

672

673The request also clears the record of browsers on which the person chose to skip Claude’s two-step verification, so that the next sign-in there asks for the second step again. It also removes the push-notification registrations that Claude holds for the person’s phones, desktop apps, and browsers, so that Claude stops sending notifications to them. This removal runs asynchronously: it usually completes within a minute, but in rare cases can take longer. A 200 doesn’t confirm either of these two steps.

674

675Only the OAuth tokens are limited to this organization. Sessions, trusted devices, and push-notification registrations belong to the person’s account, so the sign-out also reaches their other organizations and any individual plan.

676

677The request doesn’t delete anything that is already stored on a device.

678

679#### What the request doesn’t end

680

681The request doesn’t end any of the following:

682

683* **API keys:** They keep working, including Admin API keys that the person created. To stop an Admin API key, delete it in the **Keys** section of [claude.ai > Organization settings > API](https://claude.ai/admin-settings/api-access).

684* **OAuth tokens for other organizations:** To end them, send the request in each organization with that organization’s key. The person has the same `id` in every organization. OAuth tokens issued to the person’s account and not to an organization also keep working, and this request can’t end them.

685* **Claude Code cloud sessions and routines:** Sessions that run on Anthropic’s infrastructure, such as Claude Code on the web, or in one of your [self-hosted environments](https://code.claude.com/docs/en/self-hosted-environments) keep running. Work in progress when you send the request, or started soon after, can fail. The session then gets new credentials without the person signing in again, and continues. The person’s [routines](https://code.claude.com/docs/en/routines) that run on a schedule or on GitHub events keep starting new sessions. The **Sign out everywhere** action leaves these running too.

686* **Computers linked to Cowork:** They stay linked.

687* **A sign-in that is in progress:** One that’s already under way can finish during the request, or up to 5 minutes after it. If the [audit log export](https://platform.claude.com/docs/en/manage-claude/compliance-api#export-audit-logs) or [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) shows the person signing in after the request, send it again. Sign-ins to apps such as Claude Code aren’t recorded there, so if the person was signing in to one, send it again after 5 minutes.

688

689#### Who you can’t sign out

690

691The request can’t sign out the organization’s primary owner: it returns 400 with the error code `cannot_sign_out_primary_owner`. No one in your organization can sign out the primary owner, on the Members page either. The primary owner signs out their own sessions from their account settings in claude.ai.

692

693A key with the `write:members` scope can sign out everyone else. That includes owners, members whose custom roles include the permission to manage owners, and members with the `membership_admin` role. Owners and the primary owner can do the same with the **Sign out everywhere** action on the Members page. Only the member’s role in this organization counts, so you can sign out someone who is the primary owner of a different organization.

694

695The key keeps working after the person who created it changes role or leaves the organization. See [What happens to an Admin API key when the person who created it leaves?](https://platform.claude.com/docs/en/manage-claude/user-management#what-happens-to-an-admin-api-key-when-the-person-who-created-it-leaves).

696

697#### Responses

698

699| Status | Meaning |

700| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

701| 200 | The sign-out completed. It’s safe to retry: a request that finds nothing left to end also returns 200, and a second request ends any session, trusted device, or OAuth token that the person has gained since the first. |

702| 400 `cannot_sign_out_primary_owner` | The member is the primary owner, who can’t be signed out. See [Who you can’t sign out](https://platform.claude.com/docs/en/manage-claude/user-management#who-you-cant-sign-out). |

703| 400 `organization_not_enrolled_in_beta` | The endpoint isn’t available to your organization. |

704| 400 | The request omits the `anthropic-beta` value, which the message names, or the `id` in the path doesn’t start with `user_`. |

705| 401 | The key is missing, invalid, or deleted, or it was created for a parent organization and isn’t bound to one organization. |

706| 403 | The key lacks the `write:members` scope. |

707| 404 | No member with that ID is in your organization. |

708| 429 | The organization is over the [rate limit](https://platform.claude.com/docs/en/manage-claude/user-management#rate-limits) that Admin API endpoints share. The `retry-after` header says when to retry. Sign-out has no separate limit. |

709| 503 | A service that the request needs is temporarily unavailable. What the request already ended stays ended. Send the request again to end the rest. |

710

711Error responses follow the standard shape documented in [Claude API errors](https://platform.claude.com/docs/en/api/errors), with the error code in `error.details.error_code`:

712

713```json

714{

715 "type": "error",

716 "error": {

717 "type": "invalid_request_error",

718 "message": "...",

719 "details": {

720 "error_code": "cannot_sign_out_primary_owner"

721 }

722 },

723 "request_id": "req_018EeWyXxfu5pfWkrYcMdjWG"

724}

725```

726

727#### Where the sign-out is recorded

728

729Each sign-out that completes is recorded as `org_user_trusted_devices_revoked`, the same event that the **Sign out everywhere** action records. It appears in the [audit log export](https://platform.claude.com/docs/en/manage-claude/compliance-api#export-audit-logs) that owners download in claude.ai. If your organization has the Compliance API, it also appears in the [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed), with counts of the trusted devices and sessions that the request ended. A request that stops partway appears in the Activity Feed too, with `completed` set to `false`, and not in the audit log.

730

623731## Invites

624732

625733### Create an invite

from line 2563

24552563

245625643. If the person had not yet joined, the lookup returns no member; list invites and withdraw their `pending` invite instead.

24572565

2566### Respond to a lost or stolen device

2567

2568Before you need this workflow, create a key with the `write:members` and `read:members` scopes for the [sign-out endpoint](https://platform.claude.com/docs/en/manage-claude/user-management#sign-a-member-out-everywhere). If you have no key yet, an owner can use the **Sign out everywhere** action on the Members page of [claude.ai organization settings](https://claude.ai/admin-settings) in place of steps 2 to 4. An owner can’t use it on their own account: they sign out their own sessions from their account settings in claude.ai.

2569

25701. First, sign the person out of your identity provider, or disable their account there. Otherwise, whoever holds the lost device can sign in to Claude again through that device’s identity provider session or the person’s mailbox.

2571

25722. Look up the member by email address, as in step 1 of [Offboard a departing employee](https://platform.claude.com/docs/en/manage-claude/user-management#offboard-a-departing-employee). The email match tolerates variants of the same address, so check that the response is the right person.

2573

25743. Sign them out with `POST /v1/organizations/users/{user_id}/sign_out`, using the `id` from the response. [Sign a member out everywhere](https://platform.claude.com/docs/en/manage-claude/user-management#sign-a-member-out-everywhere) lists the headers that the request needs and what it ends.

2575

25764. If the request returns 503, send it again until it returns 200. If it returns 400 with `cannot_sign_out_primary_owner`, see [Who you can’t sign out](https://platform.claude.com/docs/en/manage-claude/user-management#who-you-cant-sign-out).

2577

25785. Check the [audit log export](https://platform.claude.com/docs/en/manage-claude/compliance-api#export-audit-logs) or [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) for a sign-in after the first request. If you find one, or the person was signing in to an app such as Claude Code, send the request again after 5 minutes. If you can’t send the request, use the **Sign out everywhere** action again instead. This also signs the member out of any session that they have started since, so tell them first.

2579

25806. Confirm the sign-out [where it is recorded](https://platform.claude.com/docs/en/manage-claude/user-management#where-the-sign-out-is-recorded), and review [what the request doesn’t end](https://platform.claude.com/docs/en/manage-claude/user-management#what-the-request-doesnt-end).

2581

24582582### Audit group membership

24592583

246025841. List groups and record each group’s `id`, `name`, and `role_ids`.

from line 2609

24852609

24862610### My organization uses single sign-on. Which operations work?

24872611

2488If your identity provider provisions users automatically (JIT or SCIM), invite creation returns 400. If it manages roles (advanced SSO or advanced SCIM provisioning), role updates return 400. If it manages membership (SCIM provisioning), member removals return 400. Reads work regardless.

2612If your identity provider provisions users automatically (JIT or SCIM), invite creation returns 400. If it manages roles (advanced SSO or advanced SCIM provisioning), role updates return 400. If it manages membership (SCIM provisioning), member removals return 400. Reads work regardless. So does [signing a member out everywhere](https://platform.claude.com/docs/en/manage-claude/user-management#sign-a-member-out-everywhere), whichever single sign-on mode your organization uses.

2613

2614### Does signing a member out keep them out?

2615

2616No. [Signing a member out](https://platform.claude.com/docs/en/manage-claude/user-management#sign-a-member-out-everywhere) ends their sign-in sessions, trusted devices, and OAuth tokens for your organization, but they can sign in again right away. To keep someone out, [remove them](https://platform.claude.com/docs/en/manage-claude/user-management#remove-a-member) or, if your organization requires single sign-on, disable their account in your identity provider. Disabling the account alone might not end sessions that are already open, so first sign the person out of your identity provider, then sign them out of Claude, and then remove them or disable their account.

24892617

24902618### What happens to an Admin API key when the person who created it leaves?

24912619

release-notes/overview Changed · +5 / -0 lines

### November 5, 2026

from line 12

1212 For updates to Claude Code, see the [complete CHANGELOG.md](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) in the `claude-code` repository.

1313</Tip>

1414

15### November 5, 2026

17* You can now set up an IP allowlist for your organization in the Claude Console, in beta. Requests to covered services from addresses not on your list are refused, which limits where a leaked API key can be used. Add IPv4 and IPv6 addresses or CIDR ranges, up to 1,000 per organization. See [IP allowlisting](https://platform.claude.com/docs/en/manage-claude/ip-allowlist) for what’s covered and how to set it up.

18* You can now sign a member of your **Claude Enterprise** (claude.ai) organization out of Claude everywhere with the Admin API (see the [Admin API reference](https://platform.claude.com/docs/en/api/beta/organization)). `POST /v1/organizations/users/{user_id}/sign_out` is in beta, and every request must include the `admin-user-sign-out-2026-10-08` beta header. It ends the member’s sign-in sessions and trusted devices on every browser and device, and their OAuth tokens for your organization. The member stays in the organization and can sign in again right away. See [Sign a member out everywhere](https://platform.claude.com/docs/en/manage-claude/user-management#sign-a-member-out-everywhere) for the key scope that the request needs and for what it doesn’t end.

1520### November 3, 2026

1621

1722* Text generated by Claude Mythos 5, Claude Opus 4.7, and Claude Sonnet 4.6 carries Anthropic’s text watermark on the platforms listed in [How Claude marks AI-generated content](https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content). On Claude Sonnet 4.6, text generated for a request that sets `temperature`, `top_p`, or `top_k` to a non-default value might not carry it. See [Text watermark](https://platform.claude.com/docs/en/build-with-claude/text-watermark).

manage-claude/admin-api-keys Changed · +1 / -1 lines

from line 64

6464| To call... | Select these scopes |

6565| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------- |

6666| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): list and look up members and invites; read custom roles and their permissions | `read:members` |

67| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): change member roles, remove members, and create and withdraw invites (to assign the `managed` role on a role change or an invite, also select `write:rbac_groups`) | `write:members` |

67| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): change member roles, remove members, [sign members out everywhere](https://platform.claude.com/docs/en/manage-claude/user-management#sign-a-member-out-everywhere) (beta), and create and withdraw invites (to assign the `managed` role on a role change or an invite, also select `write:rbac_groups`) | `write:members` |

6868| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): read groups and their members | `read:rbac_groups` |

6969| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): create, rename, and delete groups; add and remove group members; with `write:members`, assign the `managed` role (on an invite or a role change) or assign groups on an invite | `write:rbac_groups` |

7070| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): read plugins, versions, installation settings, shares, and marketplaces; download plugin files, including the files of members’ personal plugins; validate a marketplace before you connect it | `read:plugins` |

manage-claude/authentication Changed · +1 / -1 lines

from line 48

4848

4949You can also send the key in the legacy `x-api-key: YOUR_API_KEY` header in place of `Authorization`.

5050

51Store API keys in a secrets manager, rotate them periodically, and disable or delete any key you suspect has leaked. On the [API keys](https://platform.claude.com/settings/keys) page in the Claude Console, **Disable** is reversible (the Admin API reports the key’s `status` as `"inactive"`, and **Re-enable** returns it to `"active"`), whereas **Delete** is permanent: the key is archived and still appears in [List API Keys](https://platform.claude.com/docs/en/api/organization/api_keys/list) with `status: "archived"`. Expired keys can only be deleted. You can also set an [expiration](https://platform.claude.com/docs/en/manage-claude/authentication#key-expiration) when you create a key to limit how long a leaked credential stays usable.

5252

5353<CodeGroup>

5454 ```bash cURL