Create Federation Rule changedapi/admin/federation_rules/create
Nearest release: v2.1.245, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+43added
Lines−26removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits4to this page, all time
# Create Federation Rule ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Create Federation Rule ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
The whole hunk
from line 1, old and new numbered
/
from line 1
1---
2title: Create Federation Rule
3url: https://platform.claude.com/docs/en/api/admin/federation_rules/create
4---
1# Create Federation Rule
52
6## Create Federation Rule
3**POST** `/v1/organizations/federation_rules`
74
8**post** `/v1/organizations/federation_rules`
9
105Create a federation rule owned by your organization.
116
127The referenced issuer and the target service account must already exist
from line 19
2419`workspace:inference`; other scopes require a Console session. Admin API
2520keys are not accepted.
2621
27### Header Parameters
22## Headers
2823
2924- `"anthropic-beta": optional array of string`
3025
from line 27
3227
3328 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
3429
35### Body Parameters
30## Body parameters
3631
3732- `issuer_id: string`
3833
3934 Tagged ID of the federation issuer.
4035
41- `match: object { audience, claims, condition, subject_prefix }`
36- `match: object`
4237
4338 Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.
4439
from line 41
4641
4742 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
4843
44 maxLength: 1024
45
4946 - `claims: optional map[string] or null`
5047
5148 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 51
5451
5552 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
5653
54 maxLength: 4096
55
5756 - `subject_prefix: optional string or null`
5857
5958 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
6059
60 maxLength: 1024
61
6162- `name: string`
6263
6364 Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
6465
66 maxLength: 255, minLength: 1
67
6568- `oauth_scope: string`
6669
6770 Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
6871
69- `target: object { service_account_id, type, service_account_name }`
72 minLength: 1
7073
74- `target: object`
75
7176 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
7277
7378 - `service_account_id: string`
from line 81
7681
7782 - `type: "service_account"`
7883
79 - `"service_account"`
80
8184 - `service_account_name: optional string or null`
8285
8386 Service account's display name at read time. Ignored on writes.
from line 97
9497
9598 Optional free-text description.
9699
100 maxLength: 2000
101
97102- `token_lifetime_seconds: optional number`
98103
99104 Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
100105
106 maximum: 86400, minimum: 60
107
101108- `workspace_id: optional string or null`
102109
103110 Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.
104111
105### Returns
112## Returns
106113
107- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
114- `FederationRule object`
108115
109116 Authorization rule binding an external OIDC identity to Anthropic.
110117
from line 136
129136
130137 If set, this rule is archived and rejects token exchange.
131138
139 format: date-time
140
132141 - `archived_by_actor_id: string or null`
133142
134143 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 150
141150
142151 When this rule was created.
143152
153 format: date-time
154
144155 - `created_by_actor_id: string or null`
145156
146157 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 168
157168
158169 Issuer's display name at read time.
159170
160 - `match: object { audience, claims, condition, subject_prefix }`
171 - `match: object`
161172
162173 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
163174
from line 176
165176
166177 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
167178
179 maxLength: 1024
180
168181 - `claims: optional map[string] or null`
169182
170183 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 186
173186
174187 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
175188
189 maxLength: 4096
190
176191 - `subject_prefix: optional string or null`
177192
178193 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
179194
195 maxLength: 1024
196
180197 - `name: string`
181198
182199 Admin-chosen slug identifier.
from line 202
185202
186203 Space-separated OAuth scopes granted on the minted token.
187204
188 - `target: object { service_account_id, type, service_account_name }`
205 - `target: object`
189206
190207 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
191208
from line 212
195212
196213 - `type: "service_account"`
197214
198 - `"service_account"`
199
200215 - `service_account_name: optional string or null`
201216
202217 Service account's display name at read time. Ignored on writes.
from line 222
207222
208223 - `type: "federation_rule"`
209224
210 - `"federation_rule"`
225 default: federation_rule
211226
212227 - `updated_at: string`
213228
214229 When this rule was last updated.
215230
231 format: date-time
232
216233 - `updated_by_actor_id: string or null`
217234
218235 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 242
225242
226243 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
227244
228### Example
245## Example
229246
230```http
247```bash
231248curl https://api.anthropic.com/v1/organizations/federation_rules \
232249 -H 'Content-Type: application/json' \
233250 -H 'anthropic-version: 2023-06-01' \
from line 261
244261 }'
245262```
246263
247#### Response
264### Response (200)
248265
249266```json
250267{
No line in this hunk matches that.