Federation Rules changedapi/admin/federation_rules
Nearest release: v2.1.245, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+203added
Lines−188removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits4to this page, all time
### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers ### Body parameters #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ## Federation Rules › Workspaces ### List Federation Rule Workspaces #### Path parameters #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Add Federation Rule Workspace #### Path parameters #### Headers #### Body parameters #### Returns #### Example ##### Response (200) ### Remove Federation Rule Workspace #### Path parameters #### Headers #### Returns #### Example ##### Response (200) ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters ### Body Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types # Workspaces ## List Federation Rule Workspaces ### Path Parameters ### Query Parameters ### Header Parameters #### Response ## Add Federation Rule Workspace ### Path Parameters ### Header Parameters ### Body Parameters #### Response ## Remove Federation Rule Workspace ### Path Parameters ### Header Parameters #### Response ## Domain Types ### Workspace List Response ### Workspace Create Response ### Workspace Delete Response
The whole hunk
from line 1, old and new numbered
/
from line 1
1---
2title: Federation Rules
3url: https://platform.claude.com/docs/en/api/admin/federation_rules
4---
5
61# Federation Rules
72
83## Create Federation Rule
94
10**post** `/v1/organizations/federation_rules`
5**POST** `/v1/organizations/federation_rules`
116
127Create a federation rule owned by your organization.
138
from line 21
2621`workspace:inference`; other scopes require a Console session. Admin API
2722keys are not accepted.
2823
29### Header Parameters
24### Headers
3025
3126- `"anthropic-beta": optional array of string`
3227
from line 29
3429
3530 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3631
37### Body Parameters
32### Body parameters
3833
3934- `issuer_id: string`
4035
4136 Tagged ID of the federation issuer.
4237
43- `match: object { audience, claims, condition, subject_prefix }`
38- `match: object`
4439
4540 Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.
4641
from line 43
4843
4944 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
5045
46 maxLength: 1024
47
5148 - `claims: optional map[string] or null`
5249
5350 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 53
5653
5754 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
5855
56 maxLength: 4096
57
5958 - `subject_prefix: optional string or null`
6059
6160 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
6261
62 maxLength: 1024
63
6364- `name: string`
6465
6566 Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
6667
68 maxLength: 255, minLength: 1
69
6770- `oauth_scope: string`
6871
6972 Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
7073
71- `target: object { service_account_id, type, service_account_name }`
74 minLength: 1
7275
76- `target: object`
77
7378 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
7479
7580 - `service_account_id: string`
from line 83
7883
7984 - `type: "service_account"`
8085
81 - `"service_account"`
82
8386 - `service_account_name: optional string or null`
8487
8588 Service account's display name at read time. Ignored on writes.
from line 99
9699
97100 Optional free-text description.
98101
102 maxLength: 2000
103
99104- `token_lifetime_seconds: optional number`
100105
101106 Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
102107
108 maximum: 86400, minimum: 60
109
103110- `workspace_id: optional string or null`
104111
105112 Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.
from line 113
106113
107114### Returns
108115
109- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
116- `FederationRule object`
110117
111118 Authorization rule binding an external OIDC identity to Anthropic.
112119
from line 138
131138
132139 If set, this rule is archived and rejects token exchange.
133140
141 format: date-time
142
134143 - `archived_by_actor_id: string or null`
135144
136145 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 152
143152
144153 When this rule was created.
145154
155 format: date-time
156
146157 - `created_by_actor_id: string or null`
147158
148159 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 170
159170
160171 Issuer's display name at read time.
161172
162 - `match: object { audience, claims, condition, subject_prefix }`
173 - `match: object`
163174
164175 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
165176
from line 178
167178
168179 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
169180
181 maxLength: 1024
182
170183 - `claims: optional map[string] or null`
171184
172185 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 188
175188
176189 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
177190
191 maxLength: 4096
192
178193 - `subject_prefix: optional string or null`
179194
180195 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
181196
197 maxLength: 1024
198
182199 - `name: string`
183200
184201 Admin-chosen slug identifier.
from line 204
187204
188205 Space-separated OAuth scopes granted on the minted token.
189206
190 - `target: object { service_account_id, type, service_account_name }`
207 - `target: object`
191208
192209 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
193210
from line 214
197214
198215 - `type: "service_account"`
199216
200 - `"service_account"`
201
202217 - `service_account_name: optional string or null`
203218
204219 Service account's display name at read time. Ignored on writes.
from line 224
209224
210225 - `type: "federation_rule"`
211226
212 - `"federation_rule"`
227 default: federation_rule
213228
214229 - `updated_at: string`
215230
216231 When this rule was last updated.
217232
233 format: date-time
234
218235 - `updated_by_actor_id: string or null`
219236
220237 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 246
229246
230247### Example
231248
232```http
249```bash
233250curl https://api.anthropic.com/v1/organizations/federation_rules \
234251 -H 'Content-Type: application/json' \
235252 -H 'anthropic-version: 2023-06-01' \
from line 263
246263 }'
247264```
248265
249#### Response
266#### Response (200)
250267
251268```json
252269{
from line 307
290307
291308## Get Federation Rule
292309
293**get** `/v1/organizations/federation_rules/{federation_rule_id}`
310**GET** `/v1/organizations/federation_rules/{federation_rule_id}`
294311
295312Retrieve a federation rule by its ID (`fdrl_...`).
296313
297### Path Parameters
314### Path parameters
298315
299316- `federation_rule_id: string`
300317
301318 ID of the federation rule.
302319
303### Header Parameters
320### Headers
304321
305322- `"anthropic-beta": optional array of string`
306323
from line 327
310327
311328### Returns
312329
313- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
330- `FederationRule object`
314331
315332 Authorization rule binding an external OIDC identity to Anthropic.
316333
from line 352
335352
336353 If set, this rule is archived and rejects token exchange.
337354
355 format: date-time
356
338357 - `archived_by_actor_id: string or null`
339358
340359 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 366
347366
348367 When this rule was created.
349368
369 format: date-time
370
350371 - `created_by_actor_id: string or null`
351372
352373 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 384
363384
364385 Issuer's display name at read time.
365386
366 - `match: object { audience, claims, condition, subject_prefix }`
387 - `match: object`
367388
368389 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
369390
from line 392
371392
372393 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
373394
395 maxLength: 1024
396
374397 - `claims: optional map[string] or null`
375398
376399 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 402
379402
380403 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
381404
405 maxLength: 4096
406
382407 - `subject_prefix: optional string or null`
383408
384409 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
385410
411 maxLength: 1024
412
386413 - `name: string`
387414
388415 Admin-chosen slug identifier.
from line 418
391418
392419 Space-separated OAuth scopes granted on the minted token.
393420
394 - `target: object { service_account_id, type, service_account_name }`
421 - `target: object`
395422
396423 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
397424
from line 428
401428
402429 - `type: "service_account"`
403430
404 - `"service_account"`
405
406431 - `service_account_name: optional string or null`
407432
408433 Service account's display name at read time. Ignored on writes.
from line 438
413438
414439 - `type: "federation_rule"`
415440
416 - `"federation_rule"`
441 default: federation_rule
417442
418443 - `updated_at: string`
419444
420445 When this rule was last updated.
421446
447 format: date-time
448
422449 - `updated_by_actor_id: string or null`
423450
424451 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 460
433460
434461### Example
435462
436```http
463```bash
437464curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
438465 -H 'anthropic-version: 2023-06-01' \
439466 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
440467```
441468
442#### Response
469#### Response (200)
443470
444471```json
445472{
from line 510
483510
484511## List Federation Rules
485512
486**get** `/v1/organizations/federation_rules`
513**GET** `/v1/organizations/federation_rules`
487514
488515List federation rules in your organization.
489516
from line 517
490517Optionally filter by issuer with `issuer_id`. Archived rules are excluded
491518unless `include_archived=true`.
492519
493### Query Parameters
520### Query parameters
494521
495522- `include_archived: optional boolean`
496523
497524 Include archived resources. Defaults to false.
498525
526 default: false
527
499528- `issuer_id: optional string`
500529
501530 Filter to rules referencing this federation issuer.
from line 533
504533
505534 Number of results per page.
506535
536 default: 20, maximum: 100, minimum: 1
537
507538- `page: optional string`
508539
509540 Opaque cursor from a previous response's `next_page`.
510541
511### Header Parameters
542### Headers
512543
513544- `"anthropic-beta": optional array of string`
514545
from line 563
532563
533564 If set, this rule is archived and rejects token exchange.
534565
566 format: date-time
567
535568 - `archived_by_actor_id: string or null`
536569
537570 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 577
544577
545578 When this rule was created.
546579
580 format: date-time
581
547582 - `created_by_actor_id: string or null`
548583
549584 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 595
560595
561596 Issuer's display name at read time.
562597
563 - `match: object { audience, claims, condition, subject_prefix }`
598 - `match: object`
564599
565600 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
566601
from line 603
568603
569604 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
570605
606 maxLength: 1024
607
571608 - `claims: optional map[string] or null`
572609
573610 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 613
576613
577614 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
578615
616 maxLength: 4096
617
579618 - `subject_prefix: optional string or null`
580619
581620 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
582621
622 maxLength: 1024
623
583624 - `name: string`
584625
585626 Admin-chosen slug identifier.
from line 629
588629
589630 Space-separated OAuth scopes granted on the minted token.
590631
591 - `target: object { service_account_id, type, service_account_name }`
632 - `target: object`
592633
593634 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
594635
from line 639
598639
599640 - `type: "service_account"`
600641
601 - `"service_account"`
602
603642 - `service_account_name: optional string or null`
604643
605644 Service account's display name at read time. Ignored on writes.
from line 649
610649
611650 - `type: "federation_rule"`
612651
613 - `"federation_rule"`
652 default: federation_rule
614653
615654 - `updated_at: string`
616655
617656 When this rule was last updated.
618657
658 format: date-time
659
619660 - `updated_by_actor_id: string or null`
620661
621662 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 675
634675
635676### Example
636677
637```http
678```bash
638679curl https://api.anthropic.com/v1/organizations/federation_rules \
639680 -H 'anthropic-version: 2023-06-01' \
640681 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
641682```
642683
643#### Response
684#### Response (200)
644685
645686```json
646687{
from line 730
689730
690731## Update Federation Rule
691732
692**post** `/v1/organizations/federation_rules/{federation_rule_id}`
733**POST** `/v1/organizations/federation_rules/{federation_rule_id}`
693734
694735Partially update a federation rule.
695736
from line 750
709750`workspace:developer` or `workspace:inference`; other scopes require a
710751Console session. Admin API keys are not accepted.
711752
712### Path Parameters
753### Path parameters
713754
714755- `federation_rule_id: string`
715756
716757 ID of the federation rule to update.
717758
718### Header Parameters
759### Headers
719760
720761- `"anthropic-beta": optional array of string`
721762
from line 764
723764
724765 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
725766
726### Body Parameters
767### Body parameters
727768
728769- `applies_to_all_workspaces: optional boolean or null`
729770
from line 778
737778
738779 Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).
739780
740- `match: optional object { audience, claims, condition, subject_prefix } or null`
781 maxLength: 2000
741782
783- `match: optional object or null`
784
742785 Does the incoming JWT qualify?
743786
744787 All populated fields must pass; omitted fields are skipped. At least one
from line 792
749792
750793 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
751794
795 maxLength: 1024
796
752797 - `claims: optional map[string] or null`
753798
754799 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 802
757802
758803 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
759804
805 maxLength: 4096
806
760807 - `subject_prefix: optional string or null`
761808
762809 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
763810
811 maxLength: 1024
812
764813- `name: optional string or null`
765814
766815 Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
767816
817 maxLength: 255, minLength: 1
818
768819- `oauth_scope: optional string or null`
769820
770821 Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
771822
772- `target: optional object { service_account_id, type, service_account_name } or null`
823 minLength: 1
773824
825- `target: optional object or null`
826
774827 Bind to a fixed service account by ID.
775828
776829 - `service_account_id: string`
from line 832
779832
780833 - `type: "service_account"`
781834
782 - `"service_account"`
783
784835 - `service_account_name: optional string or null`
785836
786837 Service account's display name at read time. Ignored on writes.
from line 840
789840
790841 Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
791842
843 maximum: 86400, minimum: 60
844
792845- `workspace_id: optional string or null`
793846
794847 Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead.
from line 848
795848
796849### Returns
797850
798- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
851- `FederationRule object`
799852
800853 Authorization rule binding an external OIDC identity to Anthropic.
801854
from line 873
820873
821874 If set, this rule is archived and rejects token exchange.
822875
876 format: date-time
877
823878 - `archived_by_actor_id: string or null`
824879
825880 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 887
832887
833888 When this rule was created.
834889
890 format: date-time
891
835892 - `created_by_actor_id: string or null`
836893
837894 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 905
848905
849906 Issuer's display name at read time.
850907
851 - `match: object { audience, claims, condition, subject_prefix }`
908 - `match: object`
852909
853910 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
854911
from line 913
856913
857914 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
858915
916 maxLength: 1024
917
859918 - `claims: optional map[string] or null`
860919
861920 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 923
864923
865924 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
866925
926 maxLength: 4096
927
867928 - `subject_prefix: optional string or null`
868929
869930 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
870931
932 maxLength: 1024
933
871934 - `name: string`
872935
873936 Admin-chosen slug identifier.
from line 939
876939
877940 Space-separated OAuth scopes granted on the minted token.
878941
879 - `target: object { service_account_id, type, service_account_name }`
942 - `target: object`
880943
881944 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
882945
from line 949
886949
887950 - `type: "service_account"`
888951
889 - `"service_account"`
890
891952 - `service_account_name: optional string or null`
892953
893954 Service account's display name at read time. Ignored on writes.
from line 959
898959
899960 - `type: "federation_rule"`
900961
901 - `"federation_rule"`
962 default: federation_rule
902963
903964 - `updated_at: string`
904965
905966 When this rule was last updated.
906967
968 format: date-time
969
907970 - `updated_by_actor_id: string or null`
908971
909972 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 981
918981
919982### Example
920983
921```http
984```bash
922985curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
923986 -H 'Content-Type: application/json' \
924987 -H 'anthropic-version: 2023-06-01' \
from line 989
926989 -d '{}'
927990```
928991
929#### Response
992#### Response (200)
930993
931994```json
932995{
from line 1033
9701033
9711034## Archive Federation Rule
9721035
973**post** `/v1/organizations/federation_rules/{federation_rule_id}/archive`
1036**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`
9741037
9751038Archive a federation rule.
9761039
from line 1045
9821045whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
9831046other scopes require a Console session. Admin API keys are not accepted.
9841047
985### Path Parameters
1048### Path parameters
9861049
9871050- `federation_rule_id: string`
9881051
9891052 ID of the federation rule to archive.
9901053
991### Header Parameters
1054### Headers
9921055
9931056- `"anthropic-beta": optional array of string`
9941057
from line 1061
9981061
9991062### Returns
10001063
1001- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
1064- `FederationRule object`
10021065
10031066 Authorization rule binding an external OIDC identity to Anthropic.
10041067
from line 1086
10231086
10241087 If set, this rule is archived and rejects token exchange.
10251088
1089 format: date-time
1090
10261091 - `archived_by_actor_id: string or null`
10271092
10281093 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 1100
10351100
10361101 When this rule was created.
10371102
1103 format: date-time
1104
10381105 - `created_by_actor_id: string or null`
10391106
10401107 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 1118
10511118
10521119 Issuer's display name at read time.
10531120
1054 - `match: object { audience, claims, condition, subject_prefix }`
1121 - `match: object`
10551122
10561123 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
10571124
from line 1126
10591126
10601127 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
10611128
1129 maxLength: 1024
1130
10621131 - `claims: optional map[string] or null`
10631132
10641133 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 1136
10671136
10681137 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
10691138
1139 maxLength: 4096
1140
10701141 - `subject_prefix: optional string or null`
10711142
10721143 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
10731144
1145 maxLength: 1024
1146
10741147 - `name: string`
10751148
10761149 Admin-chosen slug identifier.
from line 1152
10791152
10801153 Space-separated OAuth scopes granted on the minted token.
10811154
1082 - `target: object { service_account_id, type, service_account_name }`
1155 - `target: object`
10831156
10841157 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
10851158
from line 1162
10891162
10901163 - `type: "service_account"`
10911164
1092 - `"service_account"`
1093
10941165 - `service_account_name: optional string or null`
10951166
10961167 Service account's display name at read time. Ignored on writes.
from line 1172
11011172
11021173 - `type: "federation_rule"`
11031174
1104 - `"federation_rule"`
1175 default: federation_rule
11051176
11061177 - `updated_at: string`
11071178
11081179 When this rule was last updated.
11091180
1181 format: date-time
1182
11101183 - `updated_by_actor_id: string or null`
11111184
11121185 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 1194
11211194
11221195### Example
11231196
1124```http
1197```bash
11251198curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \
11261199 -X POST \
11271200 -H 'anthropic-version: 2023-06-01' \
from line 1201
11281201 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
11291202```
11301203
1131#### Response
1204#### Response (200)
11321205
11331206```json
11341207{
from line 1243
11701243}
11711244```
11721245
1173## Domain Types
1246## Domain types
11741247
11751248### Federation Rule
11761249
1177- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
1250- `FederationRule object`
11781251
11791252 Authorization rule binding an external OIDC identity to Anthropic.
11801253
from line 1272
11991272
12001273 If set, this rule is archived and rejects token exchange.
12011274
1275 format: date-time
1276
12021277 - `archived_by_actor_id: string or null`
12031278
12041279 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 1286
12111286
12121287 When this rule was created.
12131288
1289 format: date-time
1290
12141291 - `created_by_actor_id: string or null`
12151292
12161293 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 1304
12271304
12281305 Issuer's display name at read time.
12291306
1230 - `match: object { audience, claims, condition, subject_prefix }`
1307 - `match: object`
12311308
12321309 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
12331310
from line 1312
12351312
12361313 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
12371314
1315 maxLength: 1024
1316
12381317 - `claims: optional map[string] or null`
12391318
12401319 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 1322
12431322
12441323 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
12451324
1325 maxLength: 4096
1326
12461327 - `subject_prefix: optional string or null`
12471328
12481329 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
12491330
1331 maxLength: 1024
1332
12501333 - `name: string`
12511334
12521335 Admin-chosen slug identifier.
from line 1338
12551338
12561339 Space-separated OAuth scopes granted on the minted token.
12571340
1258 - `target: object { service_account_id, type, service_account_name }`
1341 - `target: object`
12591342
12601343 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
12611344
from line 1348
12651348
12661349 - `type: "service_account"`
12671350
1268 - `"service_account"`
1269
12701351 - `service_account_name: optional string or null`
12711352
12721353 Service account's display name at read time. Ignored on writes.
from line 1358
12771358
12781359 - `type: "federation_rule"`
12791360
1280 - `"federation_rule"`
1361 default: federation_rule
12811362
12821363 - `updated_at: string`
12831364
12841365 When this rule was last updated.
12851366
1367 format: date-time
1368
12861369 - `updated_by_actor_id: string or null`
12871370
12881371 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 1378
12951378
12961379 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
12971380
1298# Workspaces
1381## Federation Rules › Workspaces
12991382
1300## List Federation Rule Workspaces
1383### List Federation Rule Workspaces
13011384
1302**get** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
1385**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
13031386
13041387List workspaces where this federation rule is enabled.
13051388
from line 1392
13091392rules with `applies_to_all_workspaces` or a legacy single
13101393`workspace_id`, check those fields on the rule itself.
13111394
1312### Path Parameters
1395#### Path parameters
13131396
13141397- `federation_rule_id: string`
13151398
13161399 ID of the federation rule.
13171400
1318### Query Parameters
1401#### Query parameters
13191402
13201403- `limit: optional number`
13211404
13221405 Number of results per page.
13231406
1407 default: 20, maximum: 100, minimum: 1
1408
13241409- `page: optional string`
13251410
13261411 Opaque cursor from a previous response's `next_page`.
13271412
1328### Header Parameters
1413#### Headers
13291414
13301415- `"anthropic-beta": optional array of string`
13311416
from line 1418
13331418
13341419 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
13351420
1336### Returns
1421#### Returns
13371422
1338- `data: array of object { created_at, created_by_actor_id, federation_rule_id, 3 more }`
1423- `data: array of object`
13391424
13401425 - `created_at: string`
13411426
13421427 When this workspace was enabled for the rule.
13431428
1429 format: date-time
1430
13441431 - `created_by_actor_id: string or null`
13451432
13461433 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
from line 1438
13511438
13521439 - `type: "federation_rule_workspace"`
13531440
1354 - `"federation_rule_workspace"`
1441 default: federation_rule_workspace
13551442
13561443 - `workspace_id: string`
13571444
from line 1452
13651452
13661453 Opaque cursor for the next page; null when there are no more results.
13671454
1368### Example
1455#### Example
13691456
1370```http
1457```bash
13711458curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
13721459 -H 'anthropic-version: 2023-06-01' \
13731460 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
13741461```
13751462
1376#### Response
1463##### Response (200)
13771464
13781465```json
13791466{
from line 1478
13911478}
13921479```
13931480
1394## Add Federation Rule Workspace
1481### Add Federation Rule Workspace
13951482
1396**post** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
1483**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
13971484
13981485Enable a federation rule for a workspace.
13991486
from line 1493
14061493`oauth_scope` is `workspace:developer` or `workspace:inference`; other
14071494scopes require a Console session. Admin API keys are not accepted.
14081495
1409### Path Parameters
1496#### Path parameters
14101497
14111498- `federation_rule_id: string`
14121499
14131500 ID of the federation rule.
14141501
1415### Header Parameters
1502#### Headers
14161503
14171504- `"anthropic-beta": optional array of string`
14181505
from line 1507
14201507
14211508 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
14221509
1423### Body Parameters
1510#### Body parameters
14241511
14251512- `workspace_id: string`
14261513
14271514 Tagged ID of the workspace to enable this rule for.
14281515
1429### Returns
1516#### Returns
14301517
14311518- `created_at: string`
14321519
14331520 When this workspace was enabled for the rule.
14341521
1522 format: date-time
1523
14351524- `created_by_actor_id: string or null`
14361525
14371526 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
from line 1531
14421531
14431532- `type: "federation_rule_workspace"`
14441533
1445 - `"federation_rule_workspace"`
1534 default: federation_rule_workspace
14461535
14471536- `workspace_id: string`
14481537
from line 1541
14521541
14531542 Workspace display name. Populated when listing; null in the enable response.
14541543
1455### Example
1544#### Example
14561545
1457```http
1546```bash
14581547curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
14591548 -H 'Content-Type: application/json' \
14601549 -H 'anthropic-version: 2023-06-01' \
from line 1553
14641553 }'
14651554```
14661555
1467#### Response
1556##### Response (200)
14681557
14691558```json
14701559{
from line 1566
14771566}
14781567```
14791568
1480## Remove Federation Rule Workspace
1569### Remove Federation Rule Workspace
14811570
1482**delete** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
1571**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
14831572
14841573Disable a federation rule for a workspace.
14851574
from line 1577
14881577`workspace:developer` or `workspace:inference`; other scopes require a
14891578Console session. Admin API keys are not accepted.
14901579
1491### Path Parameters
1580#### Path parameters
14921581
14931582- `federation_rule_id: string`
14941583
from line 1587
14981587
14991588 ID of the workspace to disable for.
15001589
1501### Header Parameters
1590#### Headers
15021591
15031592- `"anthropic-beta": optional array of string`
15041593
from line 1595
15061595
15071596 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
15081597
1509### Returns
1598#### Returns
15101599
15111600- `federation_rule_id: string`
15121601
from line 1603
15141603
15151604- `type: "federation_rule_workspace_deleted"`
15161605
1517 - `"federation_rule_workspace_deleted"`
1606 default: federation_rule_workspace_deleted
15181607
15191608- `workspace_id: string`
15201609
15211610 Tagged ID of the workspace named in the delete request. Removal is idempotent.
15221611
1523### Example
1612#### Example
15241613
1525```http
1614```bash
15261615curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \
15271616 -X DELETE \
15281617 -H 'anthropic-version: 2023-06-01' \
from line 1618
15291618 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
15301619```
15311620
1532#### Response
1621##### Response (200)
15331622
15341623```json
15351624{
from line 1627
15381627 "workspace_id": "workspace_id"
15391628}
15401629```
1541
1542## Domain Types
1543
1544### Workspace List Response
1545
1546- `WorkspaceListResponse object { created_at, created_by_actor_id, federation_rule_id, 3 more }`
1547
1548 - `created_at: string`
1549
1550 When this workspace was enabled for the rule.
1551
1552 - `created_by_actor_id: string or null`
1553
1554 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
1555
1556 - `federation_rule_id: string`
1557
1558 Tagged ID of the federation rule.
1559
1560 - `type: "federation_rule_workspace"`
1561
1562 - `"federation_rule_workspace"`
1563
1564 - `workspace_id: string`
1565
1566 Tagged ID of the workspace this rule is enabled for.
1567
1568 - `workspace_name: string or null`
1569
1570 Workspace display name. Populated when listing; null in the enable response.
1571
1572### Workspace Create Response
1573
1574- `WorkspaceCreateResponse object { created_at, created_by_actor_id, federation_rule_id, 3 more }`
1575
1576 - `created_at: string`
1577
1578 When this workspace was enabled for the rule.
1579
1580 - `created_by_actor_id: string or null`
1581
1582 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.
1583
1584 - `federation_rule_id: string`
1585
1586 Tagged ID of the federation rule.
1587
1588 - `type: "federation_rule_workspace"`
1589
1590 - `"federation_rule_workspace"`
1591
1592 - `workspace_id: string`
1593
1594 Tagged ID of the workspace this rule is enabled for.
1595
1596 - `workspace_name: string or null`
1597
1598 Workspace display name. Populated when listing; null in the enable response.
1599
1600### Workspace Delete Response
1601
1602- `WorkspaceDeleteResponse object { federation_rule_id, type, workspace_id }`
1603
1604 - `federation_rule_id: string`
1605
1606 Tagged ID of the federation rule.
1607
1608 - `type: "federation_rule_workspace_deleted"`
1609
1610 - `"federation_rule_workspace_deleted"`
1611
1612 - `workspace_id: string`
1613
1614 Tagged ID of the workspace named in the delete request. Removal is idempotent.
16151630
No line in this hunk matches that.