Update Federation Rule changedapi/admin/federation_rules/update
Nearest release: v2.1.245, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+44added
Lines−27removed
From line
1
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits4to this page, all time
# Update Federation Rule ## Path parameters ## Headers ## Body parameters ## Returns ## Example ### Response (200) ## Update Federation Rule ### Path Parameters ### Header Parameters ### Body Parameters ### Returns ### Example #### Response
The whole hunk
from line 1, old and new numbered
/
from line 1
1---
2title: Update Federation Rule
3url: https://platform.claude.com/docs/en/api/admin/federation_rules/update
4---
1# Update Federation Rule
52
6## Update Federation Rule
3**POST** `/v1/organizations/federation_rules/{federation_rule_id}`
74
8**post** `/v1/organizations/federation_rules/{federation_rule_id}`
9
105Partially update a federation rule.
116
127`issuer_id` is immutable. `match` and `target` are replaced as whole
from line 20
2520`workspace:developer` or `workspace:inference`; other scopes require a
2621Console session. Admin API keys are not accepted.
2722
28### Path Parameters
23## Path parameters
2924
3025- `federation_rule_id: string`
3126
3227 ID of the federation rule to update.
3328
34### Header Parameters
29## Headers
3530
3631- `"anthropic-beta": optional array of string`
3732
from line 34
3934
4035 To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
4136
42### Body Parameters
37## Body parameters
4338
4439- `applies_to_all_workspaces: optional boolean or null`
4540
from line 48
5348
5449 Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).
5550
56- `match: optional object { audience, claims, condition, subject_prefix } or null`
51 maxLength: 2000
5752
53- `match: optional object or null`
54
5855 Does the incoming JWT qualify?
5956
6057 All populated fields must pass; omitted fields are skipped. At least one
from line 62
6562
6663 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
6764
65 maxLength: 1024
66
6867 - `claims: optional map[string] or null`
6968
7069 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 72
7372
7473 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
7574
75 maxLength: 4096
76
7677 - `subject_prefix: optional string or null`
7778
7879 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
7980
81 maxLength: 1024
82
8083- `name: optional string or null`
8184
8285 Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.
8386
87 maxLength: 255, minLength: 1
88
8489- `oauth_scope: optional string or null`
8590
8691 Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.
8792
88- `target: optional object { service_account_id, type, service_account_name } or null`
93 minLength: 1
8994
95- `target: optional object or null`
96
9097 Bind to a fixed service account by ID.
9198
9299 - `service_account_id: string`
from line 102
95102
96103 - `type: "service_account"`
97104
98 - `"service_account"`
99
100105 - `service_account_name: optional string or null`
101106
102107 Service account's display name at read time. Ignored on writes.
from line 110
105110
106111 Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
107112
113 maximum: 86400, minimum: 60
114
108115- `workspace_id: optional string or null`
109116
110117 Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead.
111118
112### Returns
119## Returns
113120
114- `FederationRule object { id, applies_to_all_workspaces, archived_at, 17 more }`
121- `FederationRule object`
115122
116123 Authorization rule binding an external OIDC identity to Anthropic.
117124
from line 143
136143
137144 If set, this rule is archived and rejects token exchange.
138145
146 format: date-time
147
139148 - `archived_by_actor_id: string or null`
140149
141150 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.
from line 157
148157
149158 When this rule was created.
150159
160 format: date-time
161
151162 - `created_by_actor_id: string or null`
152163
153164 Tagged ID (`user_`/`svac_`) of the actor that created this rule.
from line 175
164175
165176 Issuer's display name at read time.
166177
167 - `match: object { audience, claims, condition, subject_prefix }`
178 - `match: object`
168179
169180 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.
170181
from line 183
172183
173184 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
174185
186 maxLength: 1024
187
175188 - `claims: optional map[string] or null`
176189
177190 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.
from line 193
180193
181194 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.
182195
196 maxLength: 4096
197
183198 - `subject_prefix: optional string or null`
184199
185200 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.
186201
202 maxLength: 1024
203
187204 - `name: string`
188205
189206 Admin-chosen slug identifier.
from line 209
192209
193210 Space-separated OAuth scopes granted on the minted token.
194211
195 - `target: object { service_account_id, type, service_account_name }`
212 - `target: object`
196213
197214 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
198215
from line 219
202219
203220 - `type: "service_account"`
204221
205 - `"service_account"`
206
207222 - `service_account_name: optional string or null`
208223
209224 Service account's display name at read time. Ignored on writes.
from line 229
214229
215230 - `type: "federation_rule"`
216231
217 - `"federation_rule"`
232 default: federation_rule
218233
219234 - `updated_at: string`
220235
221236 When this rule was last updated.
222237
238 format: date-time
239
223240 - `updated_by_actor_id: string or null`
224241
225242 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.
from line 249
232249
233250 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).
234251
235### Example
252## Example
236253
237```http
254```bash
238255curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
239256 -H 'Content-Type: application/json' \
240257 -H 'anthropic-version: 2023-06-01' \
from line 259
242259 -d '{}'
243260```
244261
245#### Response
262### Response (200)
246263
247264```json
248265{
No line in this hunk matches that.