Source Intelligence
Follow Discord
Sweep 28 Aug 2026 · 00:00Z Build v2.1.250 478 read Stable v2.1.236 Latest v2.1.250 Next v2.1.250 Feeds RSS JSON llms.txt

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

One change

RBAC Roles

api/admin/rbac_roles

first seen The page's own history The capture it came from

Nearest release: v2.1.245, published an hour after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

api/admin/rbac_roles Changed · +61 / -165 lines

### Query parameters ### Headers #### Response (200) ### Path parameters ### Headers #### Response (200) ## Domain types ## RBAC Roles › Permissions ### List RBAC Role Permissions #### Path parameters #### Query parameters #### Headers #### Returns #### Example ##### Response (200) ### Query Parameters ### Header Parameters #### Response ### Path Parameters ### Header Parameters #### Response ## Domain Types # Permissions ## List RBAC Role Permissions ### Path Parameters ### Query Parameters ### Header Parameters #### Response ## Domain Types ### Rbac Role Permission

from line 1
----
-title: RBAC Roles
-url: https://platform.claude.com/docs/en/api/admin/rbac_roles
----
-
 # RBAC Roles
 
 ## List RBAC Roles
 
-**get** `/v1/organizations/rbac_roles`
+**GET** `/v1/organizations/rbac_roles`
 
 List RBAC Roles in the organization.
 
 The RBAC Roles API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
 
-### Query Parameters
+### Query parameters
 
 - `limit: optional number`
from line 16
 
   Defaults to `20`. Ranges from `1` to `1000`.
 
+  default: 20, maximum: 1000, minimum: 1
+
 - `page: optional string`
 
   Optionally set to the `next_page` token from the previous response.
 
-### Header Parameters
+### Headers
 
 - `"anthropic-beta": optional array of string`
from line 42
 
     RFC 3339 datetime string indicating when the RBAC Role was created.
 
+    format: date-time
+
   - `name: string`
 
     Name of the RBAC Role.
from line 54
 
     For RBAC Roles, this is always `"rbac_role"`.
 
-    - `"rbac_role"`
+    default: rbac_role
 
   - `updated_at: string`
 
     RFC 3339 datetime string indicating when the RBAC Role was last updated.
 
+    format: date-time
+
 - `has_more: boolean`
 
   Indicates whether there are more results beyond this page.
from line 73
 
 ### Example
 
-```http
+```bash
 curl https://api.anthropic.com/v1/organizations/rbac_roles \
     -H 'anthropic-version: 2023-06-01' \
     -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
 ```
 
-#### Response
+#### Response (200)
 
 ```json
 {
from line 99
 
 ## Get RBAC Role
 
-**get** `/v1/organizations/rbac_roles/{role_id}`
+**GET** `/v1/organizations/rbac_roles/{role_id}`
 
 Retrieve an RBAC Role by ID.
 
 The RBAC Roles API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
 
-### Path Parameters
+### Path parameters
 
 - `role_id: string`
 
   ID of the RBAC Role.
 
-### Header Parameters
+### Headers
 
 - `"anthropic-beta": optional array of string`
from line 121
 
 ### Returns
 
-- `RbacRole object { id, created_at, name, 2 more }`
+- `RbacRole object`
 
   - `id: string`
from line 131
 
     RFC 3339 datetime string indicating when the RBAC Role was created.
 
+    format: date-time
+
   - `name: string`
 
     Name of the RBAC Role.
from line 143
 
     For RBAC Roles, this is always `"rbac_role"`.
 
-    - `"rbac_role"`
+    default: rbac_role
 
   - `updated_at: string`
 
     RFC 3339 datetime string indicating when the RBAC Role was last updated.
 
+    format: date-time
+
 ### Example
 
-```http
+```bash
 curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID \
     -H 'anthropic-version: 2023-06-01' \
     -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
 ```
 
-#### Response
+#### Response (200)
 
 ```json
 {
from line 171
 }
 ```
 
-## Domain Types
+## Domain types
 
 ### Rbac Role
 
-- `RbacRole object { id, created_at, name, 2 more }`
+- `RbacRole object`
 
   - `id: string`
from line 185
 
     RFC 3339 datetime string indicating when the RBAC Role was created.
 
+    format: date-time
+
   - `name: string`
 
     Name of the RBAC Role.
from line 197
 
     For RBAC Roles, this is always `"rbac_role"`.
 
-    - `"rbac_role"`
+    default: rbac_role
 
   - `updated_at: string`
 
     RFC 3339 datetime string indicating when the RBAC Role was last updated.
 
-# Permissions
+    format: date-time
 
-## List RBAC Role Permissions
+## RBAC Roles › Permissions
 
-**get** `/v1/organizations/rbac_roles/{role_id}/permissions`
+### List RBAC Role Permissions
 
+**GET** `/v1/organizations/rbac_roles/{role_id}/permissions`
+
 List the permissions an RBAC Role grants.
 
 The RBAC Roles API is in beta and available to Claude Enterprise organizations only. Requests must send the `ce-user-management-2026-07-13` value in the `anthropic-beta` header.
 
-### Path Parameters
+#### Path parameters
 
 - `role_id: string`
 
   ID of the RBAC Role.
 
-### Query Parameters
+#### Query parameters
 
 - `limit: optional number`
from line 229
 
   Defaults to `20`. Ranges from `1` to `1000`.
 
+  default: 20, maximum: 1000, minimum: 1
+
 - `page: optional string`
 
   Optionally set to the `next_page` token from the previous response.
 
-### Header Parameters
+#### Headers
 
 - `"anthropic-beta": optional array of string`
from line 243
 
   To use multiple betas, use a comma separated list like `beta1,beta2` or specify the header multiple times for each beta.
 
-### Returns
+#### Returns
 
 - `data: array of RbacRolePermission`
from line 266
     `all_connectors` grants carry a tool-access action, the scope action, or
     an authentication-method action (`interactive` or `managed`).
 
-  - `resource: object { organization_id, type }  or object { connector_id, tool_name, type }  or object { connector_id, scope, type }  or 2 more`
+  - `resource: object or object or object or 2 more`
 
     What the permission applies to.
from line 273
     A tagged union: `type` names the kind of resource and determines which
     identifier fields are present.
 
-    - `Organization object { organization_id, type }`
+    - `Organization object`
 
       - `organization_id: string`
from line 283
 
         Kind of resource the permission applies to.
 
-        - `"organization"`
+        default: organization
 
-    - `ConnectorTool object { connector_id, tool_name, type }`
+    - `ConnectorTool object`
 
       - `connector_id: string`
from line 304
 
         Kind of resource the permission applies to.
 
-        - `"connector_tool"`
+        default: connector_tool
 
-    - `ConnectorScope object { connector_id, scope, type }`
+    - `ConnectorScope object`
 
       - `connector_id: string`
from line 326
 
         Kind of resource the permission applies to.
 
-        - `"connector_scope"`
+        default: connector_scope
 
-    - `Connector object { connector_id, type }`
+    - `Connector object`
 
       - `connector_id: string`
from line 338
 
         Kind of resource the permission applies to.
 
-        - `"connector"`
+        default: connector
 
-    - `AllConnectors object { type }`
+    - `AllConnectors object`
 
       - `type: "all_connectors"`
 
         Kind of resource the permission applies to.
 
-        - `"all_connectors"`
+        default: all_connectors
 
   - `type: "rbac_role_permission"`
from line 354
 
     For RBAC Role Permissions, this is always `"rbac_role_permission"`.
 
-    - `"rbac_role_permission"`
+    default: rbac_role_permission
 
 - `has_more: boolean`
from line 365
   Opaque cursor for the next page. Pass as the `page` parameter on the next
   request.
 
-### Example
+#### Example
 
-```http
+```bash
 curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID/permissions \
     -H 'anthropic-version: 2023-06-01' \
     -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
 ```
 
-#### Response
+##### Response (200)
 
 ```json
 {
from line 391
   "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"
 }
 ```
-
-## Domain Types
-
-### Rbac Role Permission
-
-- `RbacRolePermission object { action, resource, type }`
-
-  - `action: string`
-
-    Action the permission grants on the resource.
-
-    The vocabulary follows the resource: an `organization` grant carries a
-    product-feature entitlement (for example `chat`), an admin-panel
-    permission entitlement (`permission_*`), or a blanket capability-access
-    mode — `capability_access_all` grants every product-feature entitlement,
-    and `capability_access_all_ga` grants the generally-available subset as
-    it stands at permission-check time; neither mode grants model-access
-    entitlements. A consumer enumerating a role's per-feature grants should
-    treat a blanket row as granting every product-feature entitlement it
-    covers, or it will under-report the role's effective access. A `connector_tool` grant carries
-    a tool-access action (`use` or `always_allow`); a `connector_scope` grant
-    carries the scope action `grant` (the role may receive the named OAuth
-    scope when tokens are minted for the connector); `connector` and
-    `all_connectors` grants carry a tool-access action, the scope action, or
-    an authentication-method action (`interactive` or `managed`).
-
-  - `resource: object { organization_id, type }  or object { connector_id, tool_name, type }  or object { connector_id, scope, type }  or 2 more`
-
-    What the permission applies to.
-
-    A tagged union: `type` names the kind of resource and determines which
-    identifier fields are present.
-
-    - `Organization object { organization_id, type }`
-
-      - `organization_id: string`
-
-        UUID of the organization the permission applies to.
-
-      - `type: "organization"`
-
-        Kind of resource the permission applies to.
-
-        - `"organization"`
-
-    - `ConnectorTool object { connector_id, tool_name, type }`
-
-      - `connector_id: string`
-
-        ID of the connector the permission applies to.
-
-      - `tool_name: string`
-
-        Published name of the connector tool the permission applies to.
-
-        When the published name contains characters outside `[a-zA-Z0-9_-]` (or
-        collides with a reserved form), it is server-encoded into a stable
-        `{prefix}_{32-hex}` form — a shortened readable prefix of the name plus
-        a hash — from which the published name is not recoverable.
-
-      - `type: "connector_tool"`
-
-        Kind of resource the permission applies to.
-
-        - `"connector_tool"`
-
-    - `ConnectorScope object { connector_id, scope, type }`
-
-      - `connector_id: string`
-
-        ID of the connector the permission applies to.
-
-      - `scope: string`
-
-        OAuth scope the permission names — the role may receive this scope when
-        tokens are minted for the connector.
-
-        Subject to the same encoding rule as `tool_name`: a scope containing
-        characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form)
-        appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth
-        scopes routinely contain `:` and `/`, so most appear encoded.
-
-      - `type: "connector_scope"`
-
-        Kind of resource the permission applies to.
-
-        - `"connector_scope"`
-
-    - `Connector object { connector_id, type }`
-
-      - `connector_id: string`
-
-        ID of the connector the permission applies to.
-
-      - `type: "connector"`
-
-        Kind of resource the permission applies to.
-
-        - `"connector"`
-
-    - `AllConnectors object { type }`
-
-      - `type: "all_connectors"`
-
-        Kind of resource the permission applies to.
-
-        - `"all_connectors"`
-
-  - `type: "rbac_role_permission"`
-
-    Object type.
-
-    For RBAC Role Permissions, this is always `"rbac_role_permission"`.
-
-    - `"rbac_role_permission"`