## Versioning
The whole hunk
from line 27, old and new numbered
/
lines
from line 27
2727<Check>
2828 **Scoped Admin API key required**
2929
30 These endpoints require an Admin API key with the `read:members` scope (member and invite `GET` endpoints, and all custom-role endpoints; there is no separate role scope), the `write:members` scope (member and invite `POST` and `DELETE` endpoints), the `read:rbac_groups` scope (group `GET` endpoints), or the `write:rbac_groups` scope (group `POST` and `DELETE` endpoints). A key carrying the `read:org_audit` scope (a read-only scope for security-audit integrations) can also call every `GET` endpoint on this page and the [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) read endpoints. See [Create an Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#create-a-key-for-a-claude-enterprise-organization) for where your primary owner creates one and which scopes to select. Pass the key in the `x-api-key` header on every request. Member and invite requests also require the `anthropic-version: 2023-06-01` header, as shown in the examples; group and custom-role requests do not.
30 These endpoints require an Admin API key with the `read:members` scope (member and invite `GET` endpoints, and all custom-role endpoints; there is no separate role scope), the `write:members` scope (member and invite `POST` and `DELETE` endpoints), the `read:rbac_groups` scope (group `GET` endpoints), or the `write:rbac_groups` scope (group `POST` and `DELETE` endpoints). A key carrying the `read:org_audit` scope (a read-only scope for security-audit integrations) can also call every `GET` endpoint on this page and the [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) read endpoints. See [Create an Admin API key](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#create-a-key-for-a-claude-enterprise-organization) for where your primary owner creates one and which scopes to select. Pass the key in the `x-api-key` header on every request, together with the [`anthropic-version`](https://platform.claude.com/docs/en/api/versioning) header.
3131</Check>
3232
3333## Overview
from line 98
9898
9999Groups connect members to custom roles (role-based access control, the `rbac` in the endpoint paths and scope names). Groups are owned by your enterprise as a whole (the parent organization together with every organization under it) rather than by a single organization, so the group scopes (`read:rbac_groups` and `write:rbac_groups`) require a key created for all linked organizations. Each group carries a `source_type`: `direct` for groups created in claude.ai, `scim` for groups provisioned by your identity provider. A group's `roles` field lists the IDs of the custom roles attached to it; resolve them to names and permissions with the [custom role endpoints](https://platform.claude.com/docs/en/manage-claude/user-management#custom-roles), noting that the role catalog is per-organization while groups are enterprise-wide, so fetching a role that belongs to a different organization of your enterprise returns 404 for your key. The field is `null` (rather than `[]`) when role data was temporarily unavailable, so retry to distinguish a degraded read from a group with no roles.
100100
101## Versioning
102
103Send the `anthropic-version` header on every request; see [API versions](https://platform.claude.com/docs/en/api/versioning) for the available versions.
104
101105## Rate limits
102106
103107Admin API endpoints share a per-organization limit of **100 requests per minute**; invite creation has its own limit of **1,200 requests per hour** instead. Requests over a limit return **429 Too Many Requests**.
from line 249
245249
246250## Groups
247251
248Groups your enterprise creates directly, in [claude.ai organization settings](https://claude.ai/admin-settings) or through this API (`source_type: "direct"`), support every endpoint in this section. Groups provisioned by your identity provider (`source_type: "scim"`) can be read but not modified: renaming or deleting a SCIM group, or changing its membership, returns 400, because your identity provider owns it. Unlike member and invite requests, group requests do not require the `anthropic-version` header.
252Groups your enterprise creates directly, in [claude.ai organization settings](https://claude.ai/admin-settings) or through this API (`source_type: "direct"`), support every endpoint in this section. Groups provisioned by your identity provider (`source_type: "scim"`) can be read but not modified: renaming or deleting a SCIM group, or changing its membership, returns 400, because your identity provider owns it.
249253
250254### List groups
251255
from line 259
255259
256260```bash cURL
257261curl "https://api.anthropic.com/v1/organizations/rbac_groups?limit=20" \
258 -H "x-api-key: $ANTHROPIC_ADMIN_KEY"
262 -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
263 -H "anthropic-version: 2023-06-01"
259264```
260265
261266```json
from line 289
284289
285290```bash cURL
286291curl "https://api.anthropic.com/v1/organizations/rbac_groups/rbac_group_01UvWxYzAbCdEfGhIjKlMn" \
287 -H "x-api-key: $ANTHROPIC_ADMIN_KEY"
292 -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
293 -H "anthropic-version: 2023-06-01"
288294```
289295
290296### Create a group
from line 303
297303curl -X POST "https://api.anthropic.com/v1/organizations/rbac_groups" \
298304 -H "content-type: application/json" \
299305 -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
306 -H "anthropic-version: 2023-06-01" \
300307 -d '{"name": "Engineering"}'
301308```
302309
from line 329
322329curl -X POST "https://api.anthropic.com/v1/organizations/rbac_groups/rbac_group_01UvWxYzAbCdEfGhIjKlMn" \
323330 -H "content-type: application/json" \
324331 -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
332 -H "anthropic-version: 2023-06-01" \
325333 -d '{"name": "Platform Engineering"}'
326334```
327335
from line 341
333341
334342```bash cURL
335343curl -X DELETE "https://api.anthropic.com/v1/organizations/rbac_groups/rbac_group_01UvWxYzAbCdEfGhIjKlMn" \
336 -H "x-api-key: $ANTHROPIC_ADMIN_KEY"
344 -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
345 -H "anthropic-version: 2023-06-01"
337346```
338347
339348```json
from line 360
351360
352361```bash cURL
353362curl "https://api.anthropic.com/v1/organizations/rbac_groups/rbac_group_01UvWxYzAbCdEfGhIjKlMn/members?limit=100" \
354 -H "x-api-key: $ANTHROPIC_ADMIN_KEY"
363 -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
364 -H "anthropic-version: 2023-06-01"
355365```
356366
357367```json
from line 390
380390curl -X POST "https://api.anthropic.com/v1/organizations/rbac_groups/rbac_group_01UvWxYzAbCdEfGhIjKlMn/members" \
381391 -H "content-type: application/json" \
382392 -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
393 -H "anthropic-version: 2023-06-01" \
383394 -d '{"user_id": "user_01AbCdEfGhIjKlMnOpQrSt"}'
384395```
385396
from line 412
401412
402413```bash cURL
403414curl -X DELETE "https://api.anthropic.com/v1/organizations/rbac_groups/rbac_group_01UvWxYzAbCdEfGhIjKlMn/members/user_01AbCdEfGhIjKlMnOpQrSt" \
404 -H "x-api-key: $ANTHROPIC_ADMIN_KEY"
415 -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
416 -H "anthropic-version: 2023-06-01"
405417```
406418
407419```json
from line 436
424436
425437```bash cURL
426438curl "https://api.anthropic.com/v1/organizations/rbac_roles?limit=20" \
427 -H "x-api-key: $ANTHROPIC_ADMIN_KEY"
439 -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
440 -H "anthropic-version: 2023-06-01"
428441```
429442
430443```json
from line 464
451464
452465```bash cURL
453466curl "https://api.anthropic.com/v1/organizations/rbac_roles/rbac_role_01CdEfGhIjKlMnOpQrStUv" \
454 -H "x-api-key: $ANTHROPIC_ADMIN_KEY"
467 -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
468 -H "anthropic-version: 2023-06-01"
455469```
456470
457471### List a role's permissions
from line 478
464478
465479```bash cURL
466480curl "https://api.anthropic.com/v1/organizations/rbac_roles/rbac_role_01CdEfGhIjKlMnOpQrStUv/permissions?limit=20" \
467 -H "x-api-key: $ANTHROPIC_ADMIN_KEY"
481 -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
482 -H "anthropic-version: 2023-06-01"
468483```
469484
470485```json