Follow Discord
Sweep 22 Oct 2026 · 04:32Z Build v2.1.308 527 read Stable v2.1.308 Latest v2.1.308 Next v2.1.308 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeDocsClaude Developer Platform 12 Oct 2026
One change · api

claude-platform-on-aws-iam-actions changedapi/claude-platform-on-aws-iam-actions

Recorded here
Lines+60added
Lines−60removed
From line 34 where the diff opens
First seen 14 Aug 2026 this site's first read of the page
Recorded edits9to this page, all time

The whole hunk

from line 34, old and new numbered
/
lines
from line 34
3434 
3535### Batch processing
3636 
37| Action | Routes authorized |
38| ---------------------- | ----------------------------------------------------------------------- |
39| `CreateBatchInference` | `POST /v1/messages/batches` |
40| `GetBatchInference` | `GET /v1/messages/batches/{id}` `GET /v1/messages/batches/{id}/results` |
41| `ListBatchInferences` | `GET /v1/messages/batches` |
42| `CancelBatchInference` | `POST /v1/messages/batches/{id}/cancel` |
43| `DeleteBatchInference` | `DELETE /v1/messages/batches/{id}` |
37| Action | Routes authorized |
38| ---------------------- | ---------------------------------------------------------------------------- |
39| `CreateBatchInference` | `POST /v1/messages/batches` |
40| `GetBatchInference` | `GET /v1/messages/batches/{id}`<br />`GET /v1/messages/batches/{id}/results` |
41| `ListBatchInferences` | `GET /v1/messages/batches` |
42| `CancelBatchInference` | `POST /v1/messages/batches/{id}/cancel` |
43| `DeleteBatchInference` | `DELETE /v1/messages/batches/{id}` |
4444 
4545<Note>
4646 `GetBatchInference` authorizes both reading batch metadata and downloading batch results. The `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, and `AnthropicLimitedAccess` policies' `Get*` wildcards include this action.
from line 55
5555 
5656### Files
5757 
58| Action | Routes authorized |
59| ------------ | ------------------------------------------------- |
60| `CreateFile` | `POST /v1/files` |
61| `GetFile` | `GET /v1/files/{id}` `GET /v1/files/{id}/content` |
62| `ListFiles` | `GET /v1/files` |
63| `DeleteFile` | `DELETE /v1/files/{id}` |
58| Action | Routes authorized |
59| ------------ | ------------------------------------------------------ |
60| `CreateFile` | `POST /v1/files` |
61| `GetFile` | `GET /v1/files/{id}`<br />`GET /v1/files/{id}/content` |
62| `ListFiles` | `GET /v1/files` |
63| `DeleteFile` | `DELETE /v1/files/{id}` |
6464 
6565<Note>
6666 `GetFile` authorizes both metadata and content download. A principal with read-only access can download file bytes, not just list files.
from line 68
6868 
6969### Skills
7070 
71| Action | Routes authorized |
72| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
73| `CreateSkill` | `POST /v1/skills` |
74| `GetSkill` | `GET /v1/skills/{id}` `GET /v1/skills/{id}/versions` `GET /v1/skills/{id}/versions/{version}` `GET /v1/skills/{id}/versions/{version}/content` |
75| `ListSkills` | `GET /v1/skills` |
76| `UpdateSkill` | `POST /v1/skills/{id}/versions` `DELETE /v1/skills/{id}/versions/{version}` |
77| `DeleteSkill` | `DELETE /v1/skills/{id}` |
71| Action | Routes authorized |
72| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
73| `CreateSkill` | `POST /v1/skills` |
74| `GetSkill` | `GET /v1/skills/{id}`<br />`GET /v1/skills/{id}/versions`<br />`GET /v1/skills/{id}/versions/{version}`<br />`GET /v1/skills/{id}/versions/{version}/content` |
75| `ListSkills` | `GET /v1/skills` |
76| `UpdateSkill` | `POST /v1/skills/{id}/versions`<br />`DELETE /v1/skills/{id}/versions/{version}` |
77| `DeleteSkill` | `DELETE /v1/skills/{id}` |
7878 
7979<Note>
8080 `GetSkill` authorizes both skill metadata and skill-content download. A principal with read-only access can download skill bytes, not just list skills.
from line 86
8686 
8787### Agents
8888 
89| Action | Routes authorized |
90| -------------- | ---------------------------------------------------- |
91| `CreateAgent` | `POST /v1/agents` |
92| `GetAgent` | `GET /v1/agents/{id}` `GET /v1/agents/{id}/versions` |
93| `ListAgents` | `GET /v1/agents` |
94| `UpdateAgent` | `POST /v1/agents/{id}` |
95| `ArchiveAgent` | `POST /v1/agents/{id}/archive` |
89| Action | Routes authorized |
90| -------------- | --------------------------------------------------------- |
91| `CreateAgent` | `POST /v1/agents` |
92| `GetAgent` | `GET /v1/agents/{id}`<br />`GET /v1/agents/{id}/versions` |
93| `ListAgents` | `GET /v1/agents` |
94| `UpdateAgent` | `POST /v1/agents/{id}` |
95| `ArchiveAgent` | `POST /v1/agents/{id}/archive` |
9696 
9797<Note>
9898 Agents support only archive, not hard delete. A policy that denies `aws-external-anthropic:Delete*` does not block `ArchiveAgent`. Deny `ArchiveAgent`, `UpdateAgent`, and `CreateAgent` if you need to prevent any agent mutation.
from line 100
100100 
101101### Sessions
102102 
103| Action | Routes authorized |
104| ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
105| `CreateSession` | `POST /v1/sessions` |
106| `GetSession` | `GET /v1/sessions/{id}` `GET /v1/sessions/{id}/events` `GET /v1/sessions/{id}/events/stream` `GET /v1/sessions/{id}/resources` `GET /v1/sessions/{id}/resources/{id}` |
107| `ListSessions` | `GET /v1/sessions` |
108| `UpdateSession` | `POST /v1/sessions/{id}` `POST /v1/sessions/{id}/events` `POST /v1/sessions/{id}/resources` `POST /v1/sessions/{id}/resources/{id}` `DELETE /v1/sessions/{id}/resources/{id}` |
109| `ArchiveSession` | `POST /v1/sessions/{id}/archive` |
110| `DeleteSession` | `DELETE /v1/sessions/{id}` |
103| Action | Routes authorized |
104| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
105| `CreateSession` | `POST /v1/sessions` |
106| `GetSession` | `GET /v1/sessions/{id}`<br />`GET /v1/sessions/{id}/events`<br />`GET /v1/sessions/{id}/events/stream`<br />`GET /v1/sessions/{id}/resources`<br />`GET /v1/sessions/{id}/resources/{id}` |
107| `ListSessions` | `GET /v1/sessions` |
108| `UpdateSession` | `POST /v1/sessions/{id}`<br />`POST /v1/sessions/{id}/events`<br />`POST /v1/sessions/{id}/resources`<br />`POST /v1/sessions/{id}/resources/{id}`<br />`DELETE /v1/sessions/{id}/resources/{id}` |
109| `ArchiveSession` | `POST /v1/sessions/{id}/archive` |
110| `DeleteSession` | `DELETE /v1/sessions/{id}` |
111111 
112112<Note>
113113 `GetSession` authorizes reading session metadata, the full event stream (conversation history), and session resources. The `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, and `AnthropicLimitedAccess` policies' `Get*` wildcards include this action.
from line 119
119119 
120120### Environments
121121 
122| Action | Routes authorized |
123| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
124| `CreateEnvironment` | `POST /v1/environments` |
125| `GetEnvironment` | `GET /v1/environments/{id}` `GET /v1/environments/{id}/work` `GET /v1/environments/{id}/work/{work_id}` `GET /v1/environments/{id}/work/stats` |
126| `ListEnvironments` | `GET /v1/environments` |
127| `UpdateEnvironment` | `POST /v1/environments/{id}` |
128| `ArchiveEnvironment` | `POST /v1/environments/{id}/archive` |
129| `DeleteEnvironment` | `DELETE /v1/environments/{id}` |
130| `ProcessEnvironmentWork` | `GET /v1/environments/{id}/work/poll` `POST /v1/environments/{id}/work/{work_id}` `POST /v1/environments/{id}/work/{work_id}/ack` `POST /v1/environments/{id}/work/{work_id}/heartbeat` `POST /v1/environments/{id}/work/{work_id}/stop` |
122| Action | Routes authorized |
123| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
124| `CreateEnvironment` | `POST /v1/environments` |
125| `GetEnvironment` | `GET /v1/environments/{id}`<br />`GET /v1/environments/{id}/work`<br />`GET /v1/environments/{id}/work/{work_id}`<br />`GET /v1/environments/{id}/work/stats` |
126| `ListEnvironments` | `GET /v1/environments` |
127| `UpdateEnvironment` | `POST /v1/environments/{id}` |
128| `ArchiveEnvironment` | `POST /v1/environments/{id}/archive` |
129| `DeleteEnvironment` | `DELETE /v1/environments/{id}` |
130| `ProcessEnvironmentWork` | `GET /v1/environments/{id}/work/poll`<br />`POST /v1/environments/{id}/work/{work_id}`<br />`POST /v1/environments/{id}/work/{work_id}/ack`<br />`POST /v1/environments/{id}/work/{work_id}/heartbeat`<br />`POST /v1/environments/{id}/work/{work_id}/stop` |
131131 
132132<Note>
133133 A policy that denies `aws-external-anthropic:Delete*` does not block `ArchiveEnvironment`. `ProcessEnvironmentWork` is not matched by `Create*`, `Update*`, `Delete*`, or `Archive*` wildcards. Deny `ArchiveEnvironment`, `UpdateEnvironment`, `CreateEnvironment`, and `ProcessEnvironmentWork` as well if you need to prevent any environment mutation.
from line 139
139139 
140140### Vaults
141141 
142| Action | Routes authorized |
143| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
144| `CreateVault` | `POST /v1/vaults` |
145| `GetVault` | `GET /v1/vaults/{id}` `GET /v1/vaults/{id}/credentials` `GET /v1/vaults/{id}/credentials/{id}` |
146| `ListVaults` | `GET /v1/vaults` |
147| `UpdateVault` | `POST /v1/vaults/{id}` `POST /v1/vaults/{id}/credentials` `POST /v1/vaults/{id}/credentials/{id}` `POST /v1/vaults/{id}/credentials/{id}/archive` `DELETE /v1/vaults/{id}/credentials/{id}` |
148| `ArchiveVault` | `POST /v1/vaults/{id}/archive` |
149| `DeleteVault` | `DELETE /v1/vaults/{id}` |
142| Action | Routes authorized |
143| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
144| `CreateVault` | `POST /v1/vaults` |
145| `GetVault` | `GET /v1/vaults/{id}`<br />`GET /v1/vaults/{id}/credentials`<br />`GET /v1/vaults/{id}/credentials/{id}` |
146| `ListVaults` | `GET /v1/vaults` |
147| `UpdateVault` | `POST /v1/vaults/{id}`<br />`POST /v1/vaults/{id}/credentials`<br />`POST /v1/vaults/{id}/credentials/{id}`<br />`POST /v1/vaults/{id}/credentials/{id}/archive`<br />`DELETE /v1/vaults/{id}/credentials/{id}` |
148| `ArchiveVault` | `POST /v1/vaults/{id}/archive` |
149| `DeleteVault` | `DELETE /v1/vaults/{id}` |
150150 
151151<Note>
152152 Creating, updating, archiving, or deleting an individual vault credential maps to `UpdateVault`. Reading a credential maps to `GetVault`. Vault credential secrets are not exposed: secret fields are write-only and are never returned by `GetVault` (see [Authenticate with vaults](https://platform.claude.com/docs/en/managed-agents/vaults)). A policy that denies `aws-external-anthropic:Delete*` still allows credential deletion, and a policy that denies `aws-external-anthropic:Create*` still allows credential creation. Deny `UpdateVault`, `CreateVault`, and `ArchiveVault` as well if you need to prevent any vault mutation.
from line 154
154154 
155155### Memory stores
156156 
157| Action | Routes authorized |
158| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
159| `CreateMemoryStore` | `POST /v1/memory_stores` |
160| `GetMemoryStore` | `GET /v1/memory_stores/{id}` `GET /v1/memory_stores/{id}/memories` `GET /v1/memory_stores/{id}/memories/{id}` `GET /v1/memory_stores/{id}/memory_versions` `GET /v1/memory_stores/{id}/memory_versions/{id}` |
161| `ListMemoryStores` | `GET /v1/memory_stores` |
162| `UpdateMemoryStore` | `POST /v1/memory_stores/{id}` `POST /v1/memory_stores/{id}/memories` `POST /v1/memory_stores/{id}/memories/{id}` `DELETE /v1/memory_stores/{id}/memories/{id}` `POST /v1/memory_stores/{id}/memory_versions/{id}/redact` |
163| `ArchiveMemoryStore` | `POST /v1/memory_stores/{id}/archive` |
164| `DeleteMemoryStore` | `DELETE /v1/memory_stores/{id}` |
157| Action | Routes authorized |
158| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
159| `CreateMemoryStore` | `POST /v1/memory_stores` |
160| `GetMemoryStore` | `GET /v1/memory_stores/{id}`<br />`GET /v1/memory_stores/{id}/memories`<br />`GET /v1/memory_stores/{id}/memories/{id}`<br />`GET /v1/memory_stores/{id}/memory_versions`<br />`GET /v1/memory_stores/{id}/memory_versions/{id}` |
161| `ListMemoryStores` | `GET /v1/memory_stores` |
162| `UpdateMemoryStore` | `POST /v1/memory_stores/{id}`<br />`POST /v1/memory_stores/{id}/memories`<br />`POST /v1/memory_stores/{id}/memories/{id}`<br />`DELETE /v1/memory_stores/{id}/memories/{id}`<br />`POST /v1/memory_stores/{id}/memory_versions/{id}/redact` |
163| `ArchiveMemoryStore` | `POST /v1/memory_stores/{id}/archive` |
164| `DeleteMemoryStore` | `DELETE /v1/memory_stores/{id}` |
165165 
166166<Note>
167167 `GetMemoryStore` authorizes reading store metadata, all memories, and memory version history. The `AnthropicReadOnlyAccess`, `AnthropicInferenceAccess`, and `AnthropicLimitedAccess` policies' `Get*` wildcards include this action.
Feedback