api/admin / documentation change

The whole hunk

from line 35, old and new numbered

lines

This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.

The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.

from line 35

3535```bash

3636curl https://api.anthropic.com/v1/organizations/me \

3737 -H 'anthropic-version: 2023-06-01' \

38 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

38 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

3939```

4040

4141##### Response (200)

from line 170

170170curl https://api.anthropic.com/v1/organizations/invites \

171171 -H 'Content-Type: application/json' \

172172 -H 'anthropic-version: 2023-06-01' \

173 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

173 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

174174 -d '{

175175 "email": "[email protected]",

176176 "role": "user"

from line 288

288288```bash

289289curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \

290290 -H 'anthropic-version: 2023-06-01' \

291 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

291 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

292292```

293293

294294##### Response (200)

from line 448

448448```bash

449449curl https://api.anthropic.com/v1/organizations/invites \

450450 -H 'anthropic-version: 2023-06-01' \

451 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

451 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

452452```

453453

454454##### Response (200)

from line 508

508508curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \

509509 -X DELETE \

510510 -H 'anthropic-version: 2023-06-01' \

511 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

511 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

512512```

513513

514514##### Response (200)

from line 591

591591```bash

592592curl https://api.anthropic.com/v1/organizations/users/$USER_ID \

593593 -H 'anthropic-version: 2023-06-01' \

594 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

594 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

595595```

596596

597597##### Response (200)

from line 712

712712```bash

713713curl https://api.anthropic.com/v1/organizations/users \

714714 -H 'anthropic-version: 2023-06-01' \

715 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

715 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

716716```

717717

718718##### Response (200)

from line 823

823823curl https://api.anthropic.com/v1/organizations/users/$USER_ID \

824824 -H 'Content-Type: application/json' \

825825 -H 'anthropic-version: 2023-06-01' \

826 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

826 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

827827 -d '{

828828 "role": "user"

829829 }'

from line 874

874874curl https://api.anthropic.com/v1/organizations/users/$USER_ID \

875875 -X DELETE \

876876 -H 'anthropic-version: 2023-06-01' \

877 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

877 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

878878```

879879

880880##### Response (200)

from line 967

967967```bash

968968curl https://api.anthropic.com/v1/organizations/rbac_groups \

969969 -H 'anthropic-version: 2023-06-01' \

970 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

970 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

971971```

972972

973973##### Response (200)

from line 1055

10551055```bash

10561056curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \

10571057 -H 'anthropic-version: 2023-06-01' \

1058 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

1058 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

10591059```

10601060

10611061##### Response (200)

from line 1140

11401140curl https://api.anthropic.com/v1/organizations/rbac_groups \

11411141 -H 'Content-Type: application/json' \

11421142 -H 'anthropic-version: 2023-06-01' \

1143 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

1143 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

11441144 -d '{

11451145 "name": "Engineering"

11461146 }'

from line 1166

11661166

11671167**POST** `/v1/organizations/rbac_groups/{group_id}`

11681168

1169Update an RBAC Group's name. Groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.

1169Update an RBAC Group's name. Groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

11701170

11711171The RBAC Groups API is available to Claude Enterprise organizations only.

11721172

from line 1234

12341234curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \

12351235 -H 'Content-Type: application/json' \

12361236 -H 'anthropic-version: 2023-06-01' \

1237 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

1237 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

12381238 -d '{

12391239 "name": "Engineering"

12401240 }'

from line 1260

12601260

12611261**DELETE** `/v1/organizations/rbac_groups/{group_id}`

12621262

1263Delete an RBAC Group. Groups provisioned by an identity provider (source type `"scim"`) cannot be deleted via the API.

1263Delete an RBAC Group. Groups provisioned by an identity provider (source type `"scim"`) cannot be deleted via the API while an organization in the tenant uses SCIM provisioning.

12641264

12651265The RBAC Groups API is available to Claude Enterprise organizations only.

12661266

from line 1292

12921292curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \

12931293 -X DELETE \

12941294 -H 'anthropic-version: 2023-06-01' \

1295 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

1295 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

12961296```

12971297

12981298##### Response (200)

from line 1377

13771377```bash

13781378curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \

13791379 -H 'anthropic-version: 2023-06-01' \

1380 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

1380 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

13811381```

13821382

13831383##### Response (200)

from line 1402

14021402

14031403**POST** `/v1/organizations/rbac_groups/{group_id}/members`

14041404

1405Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.

1405Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

14061406

14071407The RBAC Groups API is available to Claude Enterprise organizations only.

14081408

from line 1454

14541454curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \

14551455 -H 'Content-Type: application/json' \

14561456 -H 'anthropic-version: 2023-06-01' \

1457 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

1457 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

14581458 -d '{

14591459 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"

14601460 }'

from line 1476

14761476

14771477**DELETE** `/v1/organizations/rbac_groups/{group_id}/members/{user_id}`

14781478

1479Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API.

1479Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

14801480

14811481The RBAC Groups API is available to Claude Enterprise organizations only.

14821482

from line 1514

15141514curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members/$USER_ID \

15151515 -X DELETE \

15161516 -H 'anthropic-version: 2023-06-01' \

1517 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

1517 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

15181518```

15191519

15201520##### Response (200)

from line 1597

15971597```bash

15981598curl https://api.anthropic.com/v1/organizations/rbac_roles \

15991599 -H 'anthropic-version: 2023-06-01' \

1600 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

1600 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

16011601```

16021602

16031603##### Response (200)

from line 1669

16691669```bash

16701670curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID \

16711671 -H 'anthropic-version: 2023-06-01' \

1672 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

1672 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

16731673```

16741674

16751675##### Response (200)

from line 1841

18411841```bash

18421842curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID/permissions \

18431843 -H 'anthropic-version: 2023-06-01' \

1844 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

1844 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

18451845```

18461846

18471847##### Response (200)

from line 1915

19151915

19161916 Geographic region for workspace data storage. Immutable after creation. Defaults to 'us' if omitted.

19171917

1918- `display_color: optional string or null`

1919

1920 Hex color code representing the Workspace in the Anthropic Console.

1921

1922 maxLength: 7, pattern: ^#[0-9A-Fa-f]{6}$

1923

19181924- `external_key_id: optional string or null`

19191925

19201926 ID of the customer-managed encryption key (CMEK) configuration to use for this

19211927 Workspace. Setting this field requires CMEK to be enabled for your

19221928 organization. When set, data stored for this Workspace is encrypted with the

1923 referenced key. Create key configurations with the External Keys API. This

1924 field is write-once: once a key is attached to a Workspace it cannot be

1925 detached or replaced. To rotate key material, rotate the underlying key on

1926 your cloud KMS; the `external_key_id` stays the same.

1929 referenced key. Create key configurations with the External Keys API. On

1930 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a

1931 single-Region key in the same AWS account and Region as the Workspace. On that

1932 platform the key is validated against this Workspace when it is attached, so a

1933 key-policy problem is reported as an error on this request. This field is write-once:

1934 once a key is attached to a Workspace it cannot be detached or replaced. To

1935 rotate key material, rotate the underlying key on your cloud KMS; the

1936 `external_key_id` stays the same.

19271937

19281938- `tags: optional map[string] or null`

19291939

from line 1959

19491959 customer-managed encryption key (CMEK) on AWS, reference this value in your

19501960 KMS key-policy condition so the key is scoped to this compartment. On GCP and

19511961 Azure, Anthropic enforces the compartment binding automatically; you do not

1952 need to reference this value in your key configuration. See the CMEK integration guide for the

1953 required key configuration, including the value used during key validation.

1962 need to reference this value in your key configuration. See the CMEK

1963 integration guide for the required key configuration; unless your organization

1964 is on Claude Platform on AWS, it includes a separate value used during key

1965 validation. On Claude Platform on AWS there is no separate validation value:

1966 the key is validated against this Workspace's own value when it is attached, so

1967 if your key policy uses the compartment condition, add this value to it before

1968 attaching the key.

19541969

19551970 - `created_at: string`

19561971

from line 2002

19872002 ID of the customer-managed encryption key (CMEK) configuration to use for this

19882003 Workspace. Setting this field requires CMEK to be enabled for your

19892004 organization. When set, data stored for this Workspace is encrypted with the

1990 referenced key. Create key configurations with the External Keys API. This

1991 field is write-once: once a key is attached to a Workspace it cannot be

1992 detached or replaced. To rotate key material, rotate the underlying key on

1993 your cloud KMS; the `external_key_id` stays the same.

2005 referenced key. Create key configurations with the External Keys API. On

2006 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a

2007 single-Region key in the same AWS account and Region as the Workspace. On that

2008 platform the key is validated against this Workspace when it is attached, so a

2009 key-policy problem is reported as an error on this request. This field is write-once:

2010 once a key is attached to a Workspace it cannot be detached or replaced. To

2011 rotate key material, rotate the underlying key on your cloud KMS; the

2012 `external_key_id` stays the same.

19942013

19952014 - `name: string`

19962015

from line 2033

20142033curl https://api.anthropic.com/v1/organizations/workspaces \

20152034 -H 'Content-Type: application/json' \

20162035 -H 'anthropic-version: 2023-06-01' \

2017 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

2036 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

20182037 -d '{

20192038 "name": "x",

2039 "display_color": "#6C5BB9",

20202040 "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",

20212041 "tags": {

20222042 "env": "prod",

from line 2101

20812101 customer-managed encryption key (CMEK) on AWS, reference this value in your

20822102 KMS key-policy condition so the key is scoped to this compartment. On GCP and

20832103 Azure, Anthropic enforces the compartment binding automatically; you do not

2084 need to reference this value in your key configuration. See the CMEK integration guide for the

2085 required key configuration, including the value used during key validation.

2104 need to reference this value in your key configuration. See the CMEK

2105 integration guide for the required key configuration; unless your organization

2106 is on Claude Platform on AWS, it includes a separate value used during key

2107 validation. On Claude Platform on AWS there is no separate validation value:

2108 the key is validated against this Workspace's own value when it is attached, so

2109 if your key policy uses the compartment condition, add this value to it before

2110 attaching the key.

20862111

20872112 - `created_at: string`

20882113

from line 2144

21192144 ID of the customer-managed encryption key (CMEK) configuration to use for this

21202145 Workspace. Setting this field requires CMEK to be enabled for your

21212146 organization. When set, data stored for this Workspace is encrypted with the

2122 referenced key. Create key configurations with the External Keys API. This

2123 field is write-once: once a key is attached to a Workspace it cannot be

2124 detached or replaced. To rotate key material, rotate the underlying key on

2125 your cloud KMS; the `external_key_id` stays the same.

2147 referenced key. Create key configurations with the External Keys API. On

2148 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a

2149 single-Region key in the same AWS account and Region as the Workspace. On that

2150 platform the key is validated against this Workspace when it is attached, so a

2151 key-policy problem is reported as an error on this request. This field is write-once:

2152 once a key is attached to a Workspace it cannot be detached or replaced. To

2153 rotate key material, rotate the underlying key on your cloud KMS; the

2154 `external_key_id` stays the same.

21262155

21272156 - `name: string`

21282157

from line 2174

21452174```bash

21462175curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID \

21472176 -H 'anthropic-version: 2023-06-01' \

2148 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

2177 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

21492178```

21502179

21512180##### Response (200)

from line 2251

22222251 customer-managed encryption key (CMEK) on AWS, reference this value in your

22232252 KMS key-policy condition so the key is scoped to this compartment. On GCP and

22242253 Azure, Anthropic enforces the compartment binding automatically; you do not

2225 need to reference this value in your key configuration. See the CMEK integration guide for the

2226 required key configuration, including the value used during key validation.

2254 need to reference this value in your key configuration. See the CMEK

2255 integration guide for the required key configuration; unless your organization

2256 is on Claude Platform on AWS, it includes a separate value used during key

2257 validation. On Claude Platform on AWS there is no separate validation value:

2258 the key is validated against this Workspace's own value when it is attached, so

2259 if your key policy uses the compartment condition, add this value to it before

2260 attaching the key.

22272261

22282262 - `created_at: string`

22292263

from line 2294

22602294 ID of the customer-managed encryption key (CMEK) configuration to use for this

22612295 Workspace. Setting this field requires CMEK to be enabled for your

22622296 organization. When set, data stored for this Workspace is encrypted with the

2263 referenced key. Create key configurations with the External Keys API. This

2264 field is write-once: once a key is attached to a Workspace it cannot be

2265 detached or replaced. To rotate key material, rotate the underlying key on

2266 your cloud KMS; the `external_key_id` stays the same.

2297 referenced key. Create key configurations with the External Keys API. On

2298 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a

2299 single-Region key in the same AWS account and Region as the Workspace. On that

2300 platform the key is validated against this Workspace when it is attached, so a

2301 key-policy problem is reported as an error on this request. This field is write-once:

2302 once a key is attached to a Workspace it cannot be detached or replaced. To

2303 rotate key material, rotate the underlying key on your cloud KMS; the

2304 `external_key_id` stays the same.

22672305

22682306 - `name: string`

22692307

from line 2336

22982336```bash

22992337curl https://api.anthropic.com/v1/organizations/workspaces \

23002338 -H 'anthropic-version: 2023-06-01' \

2301 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

2339 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

23022340```

23032341

23042342##### Response (200)

from line 2406

23682406

23692407 - `"us"`

23702408

2409- `display_color: optional string`

2410

2411 Hex color code representing the Workspace in the Anthropic Console.

2412

2413 maxLength: 7, pattern: ^#[0-9A-Fa-f]{6}$

2414

23712415- `external_key_id: optional string`

23722416

23732417 ID of the customer-managed encryption key (CMEK) configuration to use for this

23742418 Workspace. Setting this field requires CMEK to be enabled for your

23752419 organization. When set, data stored for this Workspace is encrypted with the

2376 referenced key. Create key configurations with the External Keys API. This

2377 field is write-once: once a key is attached to a Workspace it cannot be

2378 detached or replaced. To rotate key material, rotate the underlying key on

2379 your cloud KMS; the `external_key_id` stays the same.

2420 referenced key. Create key configurations with the External Keys API. On

2421 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a

2422 single-Region key in the same AWS account and Region as the Workspace. On that

2423 platform the key is validated against this Workspace when it is attached, so a

2424 key-policy problem is reported as an error on this request. This field is write-once:

2425 once a key is attached to a Workspace it cannot be detached or replaced. To

2426 rotate key material, rotate the underlying key on your cloud KMS; the

2427 `external_key_id` stays the same.

23802428

23812429- `name: optional string`

23822430

from line 2456

24082456 customer-managed encryption key (CMEK) on AWS, reference this value in your

24092457 KMS key-policy condition so the key is scoped to this compartment. On GCP and

24102458 Azure, Anthropic enforces the compartment binding automatically; you do not

2411 need to reference this value in your key configuration. See the CMEK integration guide for the

2412 required key configuration, including the value used during key validation.

2459 need to reference this value in your key configuration. See the CMEK

2460 integration guide for the required key configuration; unless your organization

2461 is on Claude Platform on AWS, it includes a separate value used during key

2462 validation. On Claude Platform on AWS there is no separate validation value:

2463 the key is validated against this Workspace's own value when it is attached, so

2464 if your key policy uses the compartment condition, add this value to it before

2465 attaching the key.

24132466

24142467 - `created_at: string`

24152468

from line 2499

24462499 ID of the customer-managed encryption key (CMEK) configuration to use for this

24472500 Workspace. Setting this field requires CMEK to be enabled for your

24482501 organization. When set, data stored for this Workspace is encrypted with the

2449 referenced key. Create key configurations with the External Keys API. This

2450 field is write-once: once a key is attached to a Workspace it cannot be

2451 detached or replaced. To rotate key material, rotate the underlying key on

2452 your cloud KMS; the `external_key_id` stays the same.

2502 referenced key. Create key configurations with the External Keys API. On

2503 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a

2504 single-Region key in the same AWS account and Region as the Workspace. On that

2505 platform the key is validated against this Workspace when it is attached, so a

2506 key-policy problem is reported as an error on this request. This field is write-once:

2507 once a key is attached to a Workspace it cannot be detached or replaced. To

2508 rotate key material, rotate the underlying key on your cloud KMS; the

2509 `external_key_id` stays the same.

24532510

24542511 - `name: string`

24552512

from line 2530

24732530curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID \

24742531 -H 'Content-Type: application/json' \

24752532 -H 'anthropic-version: 2023-06-01' \

2476 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

2533 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

24772534 -d '{

2535 "display_color": "#6C5BB9",

24782536 "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",

24792537 "tags": {

24802538 "env": "prod",

from line 2595

25372595 customer-managed encryption key (CMEK) on AWS, reference this value in your

25382596 KMS key-policy condition so the key is scoped to this compartment. On GCP and

25392597 Azure, Anthropic enforces the compartment binding automatically; you do not

2540 need to reference this value in your key configuration. See the CMEK integration guide for the

2541 required key configuration, including the value used during key validation.

2598 need to reference this value in your key configuration. See the CMEK

2599 integration guide for the required key configuration; unless your organization

2600 is on Claude Platform on AWS, it includes a separate value used during key

2601 validation. On Claude Platform on AWS there is no separate validation value:

2602 the key is validated against this Workspace's own value when it is attached, so

2603 if your key policy uses the compartment condition, add this value to it before

2604 attaching the key.

25422605

25432606 - `created_at: string`

25442607

from line 2638

25752638 ID of the customer-managed encryption key (CMEK) configuration to use for this

25762639 Workspace. Setting this field requires CMEK to be enabled for your

25772640 organization. When set, data stored for this Workspace is encrypted with the

2578 referenced key. Create key configurations with the External Keys API. This

2579 field is write-once: once a key is attached to a Workspace it cannot be

2580 detached or replaced. To rotate key material, rotate the underlying key on

2581 your cloud KMS; the `external_key_id` stays the same.

2641 referenced key. Create key configurations with the External Keys API. On

2642 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a

2643 single-Region key in the same AWS account and Region as the Workspace. On that

2644 platform the key is validated against this Workspace when it is attached, so a

2645 key-policy problem is reported as an error on this request. This field is write-once:

2646 once a key is attached to a Workspace it cannot be detached or replaced. To

2647 rotate key material, rotate the underlying key on your cloud KMS; the

2648 `external_key_id` stays the same.

25822649

25832650 - `name: string`

25842651

from line 2669

26022669curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/archive \

26032670 -X POST \

26042671 -H 'anthropic-version: 2023-06-01' \

2605 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

2672 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

26062673```

26072674

26082675##### Response (200)

from line 2768

27012768curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members \

27022769 -H 'Content-Type: application/json' \

27032770 -H 'anthropic-version: 2023-06-01' \

2704 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

2771 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

27052772 -d '{

27062773 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",

27072774 "workspace_role": "workspace_admin"

from line 2841

27742841```bash

27752842curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members/$USER_ID \

27762843 -H 'anthropic-version: 2023-06-01' \

2777 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

2844 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

27782845```

27792846

27802847##### Response (200)

from line 2936

28692936```bash

28702937curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members \

28712938 -H 'anthropic-version: 2023-06-01' \

2872 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

2939 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

28732940```

28742941

28752942##### Response (200)

from line 3029

29623029curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members/$USER_ID \

29633030 -H 'Content-Type: application/json' \

29643031 -H 'anthropic-version: 2023-06-01' \

2965 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

3032 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

29663033 -d '{

29673034 "workspace_role": "workspace_admin"

29683035 }'

from line 3086

30193086curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members/$USER_ID \

30203087 -X DELETE \

30213088 -H 'anthropic-version: 2023-06-01' \

3022 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

3089 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

30233090```

30243091

30253092##### Response (200)

from line 3111

30443111override. Groups without overrides inherit the organization limits and

30453112are not listed; use `GET /v1/organizations/rate_limits` to see those.

30463113

3114When `limit` is omitted, every matching entry is returned in a single

3115page; when `limit` truncates the result, follow `next_page` to fetch

3116the remaining entries.

3117

30473118#### Path parameters

30483119

30493120- `workspace_id: string`

from line 3139

30683139

30693140 - `"web_search"`

30703141

3142- `limit: optional number`

3143

3144 Maximum number of items to return per page. Ranges from `1` to `1000`.

3145

3146 When omitted, every remaining entry is returned in a single page and `next_page` is `null`.

3147

3148 maximum: 1000, minimum: 1

3149

30713150- `page: optional string`

30723151

30733152 Opaque cursor from a previous response's `next_page`.

from line 3209

31303209

31313210- `next_page: string or null`

31323211

3133 Token to provide in as `page` in the subsequent request to retrieve the next page of data.

3212 Opaque cursor for the next page of results, or `null` when no entries remain beyond this response.

31343213

31353214#### Example

31363215

31373216```bash

31383217curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/rate_limits \

31393218 -H 'anthropic-version: 2023-06-01' \

3140 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

3219 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

31413220```

31423221

31433222##### Response (200)

from line 3251

31723251

31733252**POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts`

31743253

3254**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

3255

31753256Add a service account to a workspace with the given `workspace_role`.

31763257

31773258The role determines what the service account can do in the workspace and

from line 3262

31813262assigns a chosen role. If the service account is already an explicit

31823263member of the workspace, its `workspace_role` is replaced with the

31833264value supplied here. Archived workspaces return 400. Archived service

3184accounts cannot be added and are rejected. Requires an OAuth bearer or

3185Console session; Admin API keys are not accepted.

3265accounts cannot be added and are rejected.

31863266

31873267#### Path parameters

31883268

from line 3338

32583338curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts \

32593339 -H 'Content-Type: application/json' \

32603340 -H 'anthropic-version: 2023-06-01' \

3261 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

3341 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

32623342 -d '{

32633343 "service_account_id": "service_account_id",

32643344 "workspace_role": "workspace_admin"

from line 3362

32823362

32833363**GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`

32843364

3365**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

3366

32853367Retrieve a service account's membership in a workspace.

32863368

32873369Returns the membership record, including the service account's

from line 3432

33503432```bash

33513433curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \

33523434 -H 'anthropic-version: 2023-06-01' \

3353 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

3435 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

33543436```

33553437

33563438##### Response (200)

from line 3452

33703452

33713453**GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts`

33723454

3455**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

3456

33733457List the service accounts that are members of a workspace.

33743458

33753459Each entry includes the service account's `workspace_role`. Use `limit`

from line 3536

34523536```bash

34533537curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts \

34543538 -H 'anthropic-version: 2023-06-01' \

3455 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

3539 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

34563540```

34573541

34583542##### Response (200)

from line 3561

34773561

34783562**POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`

34793563

3564**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

3565

34803566Change a service account's role in a workspace.

34813567

34823568The new `workspace_role` replaces the current one. Only explicit

from line 3570

34843570default-workspace membership, add the service account explicitly with

34853571`POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces

34863572return 400. Archived service accounts cannot be updated and are

3487rejected. Requires an OAuth bearer or Console session; Admin API keys

3488are not accepted.

3573rejected.

34893574

34903575#### Path parameters

34913576

from line 3646

35613646curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \

35623647 -H 'Content-Type: application/json' \

35633648 -H 'anthropic-version: 2023-06-01' \

3564 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

3649 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

35653650 -d '{

35663651 "workspace_role": "workspace_admin"

35673652 }'

from line 3669

35843669

35853670**DELETE** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`

35863671

3672**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

3673

35873674Remove a service account from a workspace.

35883675

35893676Removal is idempotent (returns 200 even if the membership was already

35903677removed). A DELETE against the implicit default-workspace membership

35913678returns 200 but is a no-op and the membership persists; deleting an

35923679explicit default-workspace row reverts to the implicit `workspace_user`

3593membership. Archived workspaces return 400. Requires an OAuth bearer or

3594Console session; Admin API keys are not accepted.

3680membership. Archived workspaces return 400.

35953681

35963682#### Path parameters

35973683

from line 3717

36313717curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \

36323718 -X DELETE \

36333719 -H 'anthropic-version: 2023-06-01' \

3634 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

3720 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

36353721```

36363722

36373723##### Response (200)

from line 3873

37873873```bash

37883874curl https://api.anthropic.com/v1/organizations/api_keys/$API_KEY_ID \

37893875 -H 'anthropic-version: 2023-06-01' \

3790 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

3876 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

37913877```

37923878

37933879##### Response (200)

from line 4088

40024088```bash

40034089curl https://api.anthropic.com/v1/organizations/api_keys \

40044090 -H 'anthropic-version: 2023-06-01' \

4005 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

4091 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

40064092```

40074093

40084094##### Response (200)

from line 4285

41994285curl https://api.anthropic.com/v1/organizations/api_keys/$API_KEY_ID \

42004286 -H 'Content-Type: application/json' \

42014287 -H 'anthropic-version: 2023-06-01' \

4202 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

4288 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

42034289 -d '{}'

42044290```

42054291

from line 4334

42484334

42494335 - `kms_arn: string`

42504336

4251 Full ARN of the AWS KMS key.

4337 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.

42524338

42534339 maxLength: 2048

42544340

from line 4348

42624348

42634349 **Deprecated**

42644350

4265 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.

4351 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.

42664352

42674353 - `Gcp object`

42684354

from line 4432

43464432

43474433 - `kms_arn: string`

43484434

4349 Full ARN of the AWS KMS key.

4435 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.

43504436

43514437 maxLength: 2048

43524438

from line 4446

43604446

43614447 **Deprecated**

43624448

4363 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.

4449 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.

43644450

43654451 - `Gcp object`

43664452

from line 4490

44044490curl https://api.anthropic.com/v1/organizations/external_keys \

44054491 -H 'Content-Type: application/json' \

44064492 -H 'anthropic-version: 2023-06-01' \

4407 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

4493 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

44084494 -d '{

44094495 "provider_config": {

44104496 "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",

from line 4586

45004586

45014587 - `kms_arn: string`

45024588

4503 Full ARN of the AWS KMS key.

4589 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.

45044590

45054591 maxLength: 2048

45064592

from line 4600

45144600

45154601 **Deprecated**

45164602

4517 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.

4603 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.

45184604

45194605 - `Gcp object`

45204606

from line 4647

45614647```bash

45624648curl https://api.anthropic.com/v1/organizations/external_keys \

45634649 -H 'anthropic-version: 2023-06-01' \

4564 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

4650 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

45654651```

45664652

45674653##### Response (200)

from line 4733

46474733

46484734 - `kms_arn: string`

46494735

4650 Full ARN of the AWS KMS key.

4736 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.

46514737

46524738 maxLength: 2048

46534739

from line 4747

46614747

46624748 **Deprecated**

46634749

4664 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.

4750 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.

46654751

46664752 - `Gcp object`

46674753

from line 4790

47044790```bash

47054791curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \

47064792 -H 'anthropic-version: 2023-06-01' \

4707 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

4793 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

47084794```

47094795

47104796##### Response (200)

from line 4853

47674853

47684854 - `kms_arn: string`

47694855

4770 Full ARN of the AWS KMS key.

4856 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.

47714857

47724858 maxLength: 2048

47734859

from line 4867

47814867

47824868 **Deprecated**

47834869

4784 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.

4870 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.

47854871

47864872 - `Gcp object`

47874873

from line 4941

48554941

48564942 - `kms_arn: string`

48574943

4858 Full ARN of the AWS KMS key.

4944 Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.

48594945

48604946 maxLength: 2048

48614947

from line 4955

48694955

48704956 **Deprecated**

48714957

4872 IAM role ARN. Deprecated — Anthropic reaches the KMS key via a managed intermediate role; this field is ignored.

4958 IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.

48734959

48744960 - `Gcp object`

48754961

from line 4999

49134999curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \

49145000 -H 'Content-Type: application/json' \

49155001 -H 'anthropic-version: 2023-06-01' \

4916 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

5002 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

49175003 -d '{}'

49185004```

49195005

from line 5057

49715057curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \

49725058 -X DELETE \

49735059 -H 'anthropic-version: 2023-06-01' \

4974 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

5060 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

49755061```

49765062

49775063##### Response (200)

from line 5112

50265112curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID/validate \

50275113 -X POST \

50285114 -H 'anthropic-version: 2023-06-01' \

5029 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

5115 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

50305116```

50315117

50325118##### Response (200)

from line 5390

53045390```bash

53055391curl https://api.anthropic.com/v1/organizations/usage_report/messages \

53065392 -H 'anthropic-version: 2023-06-01' \

5307 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

5393 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

53085394```

53095395

53105396##### Response (200)

from line 5616

55305616```bash

55315617curl https://api.anthropic.com/v1/organizations/usage_report/claude_code \

55325618 -H 'anthropic-version: 2023-06-01' \

5533 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

5619 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

55345620```

55355621

55365622##### Response (200)

from line 5862

57765862```bash

57775863curl https://api.anthropic.com/v1/organizations/cost_report \

57785864 -H 'anthropic-version: 2023-06-01' \

5779 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

5865 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

57805866```

57815867

57825868##### Response (200)

from line 6140

60546140

60556141 - `"1m"`

60566142

6143- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`

6144

6145 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.

6146

6147 maxItems: 100

6148

6149 - `"dm"`

6150

6151 - `"engaged"`

6152

6153 - `"monitoring"`

6154

6155 - `"proactive"`

6156

6157 - `"scheduled"`

6158

6159- `claude_tag_user_ids: optional array of string`

6160

6161 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.

6162

6163 maxItems: 100

6164

60576165- `context_windows: optional array of "0-200k" or "200k-1M"`

60586166

60596167 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.

from line 6178

60706178

60716179 format: date-time

60726180

6073- `group_by: optional array of "context_window" or "inference_geo" or "model" or 4 more`

6181- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 6 more`

60746182

60756183 Dimensions to break each time bucket out by. Defaults to no grouping (one total per bucket). Each bucket reports at most its top 100 groups; a group beyond that cap has no row in that bucket (there is no remainder row), so grouped buckets are not exhaustive when a dimension has more than 100 distinct values.

60766184

60776185 maxItems: 100

60786186

6187 - `"claude_tag_category"`

6188

6189 - `"claude_tag_user_id"`

6190

60796191 - `"context_window"`

60806192

60816193 - `"inference_geo"`

from line 6311

61996311 - `cache_read_input_tokens: number`

62006312

62016313 The number of input tokens read from the cache.

6314

6315 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`

6316

6317 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.

6318

6319 - `"dm"`

6320

6321 - `"engaged"`

6322

6323 - `"monitoring"`

6324

6325 - `"proactive"`

6326

6327 - `"scheduled"`

6328

6329 - `claude_tag_user_id: string or null`

6330

6331 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.

62026332

62036333 - `context_window: "0-200k" or "200k-1M" or null`

62046334

from line 6436

63066436 "ephemeral_5m_input_tokens": 500

63076437 },

63086438 "cache_read_input_tokens": 0,

6439 "claude_tag_category": "dm",

6440 "claude_tag_user_id": "U0123ABCDEF",

63096441 "context_window": "0-200k",

63106442 "inference_geo": "global",

63116443 "model": "claude-opus-5",

from line 6495

63636495

63646496 - `"1m"`

63656497

6498- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`

6499

6500 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.

6501

6502 maxItems: 100

6503

6504 - `"dm"`

6505

6506 - `"engaged"`

6507

6508 - `"monitoring"`

6509

6510 - `"proactive"`

6511

6512 - `"scheduled"`

6513

6514- `claude_tag_user_ids: optional array of string`

6515

6516 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.

6517

6518 maxItems: 100

6519

63666520- `context_windows: optional array of "0-200k" or "200k-1M"`

63676521

63686522 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.

from line 6539

63856539

63866540 default: false

63876541

6388- `group_by: optional array of "context_window" or "inference_geo" or "model" or 4 more`

6542- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 6 more`

63896543

63906544 Break each actor's row out by the given dimensions. Accepts the same values as the bucketed `/usage_report` endpoint. `limit` bounds (actor × time bucket × dimension) rows — with dimensions or `bucket_width` present, one actor may span several rows.

63916545

63926546 maxItems: 100

63936547

6548 - `"claude_tag_category"`

6549

6550 - `"claude_tag_user_id"`

6551

63946552 - `"context_window"`

63956553

63966554 - `"inference_geo"`

from line 6710

65526710 - `cache_read_input_tokens: number`

65536711

65546712 The number of input tokens read from the cache.

6713

6714 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`

6715

6716 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.

6717

6718 - `"dm"`

6719

6720 - `"engaged"`

6721

6722 - `"monitoring"`

6723

6724 - `"proactive"`

6725

6726 - `"scheduled"`

6727

6728 - `claude_tag_user_id: string or null`

6729

6730 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.

65556731

65566732 - `context_window: "0-200k" or "200k-1M" or null`

65576733

from line 6849

66736849 "ephemeral_5m_input_tokens": 500

66746850 },

66756851 "cache_read_input_tokens": 3200000,

6852 "claude_tag_category": "dm",

6853 "claude_tag_user_id": "U0123ABCDEF",

66766854 "context_window": "0-200k",

66776855 "ending_at": "2019-12-27T18:11:19.117Z",

66786856 "inference_geo": "global",

from line 6909

67316909

67326910 - `"1m"`

67336911

6912- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`

6913

6914 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.

6915

6916 maxItems: 100

6917

6918 - `"dm"`

6919

6920 - `"engaged"`

6921

6922 - `"monitoring"`

6923

6924 - `"proactive"`

6925

6926 - `"scheduled"`

6927

6928- `claude_tag_user_ids: optional array of string`

6929

6930 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.

6931

6932 maxItems: 100

6933

67346934- `context_windows: optional array of "0-200k" or "200k-1M"`

67356935

67366936 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.

from line 6947

67476947

67486948 format: date-time

67496949

6750- `group_by: optional array of "context_window" or "cost_type" or "inference_geo" or 6 more`

6950- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 8 more`

67516951

67526952 Dimensions to break each time bucket out by. Defaults to no grouping (one total per bucket). Each bucket reports at most its top 100 groups; a group beyond that cap has no row in that bucket (there is no remainder row), so grouped buckets are not exhaustive when a dimension has more than 100 distinct values.

67536953

67546954 maxItems: 100

67556955

6956 - `"claude_tag_category"`

6957

6958 - `"claude_tag_user_id"`

6959

67566960 - `"context_window"`

67576961

67586962 - `"cost_type"`

from line 7072

68687072 - `amount: string`

68697073

68707074 Amount (post-discount, pre-credit) in fractional cents.

7075

7076 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`

7077

7078 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.

7079

7080 - `"dm"`

7081

7082 - `"engaged"`

7083

7084 - `"monitoring"`

7085

7086 - `"proactive"`

7087

7088 - `"scheduled"`

7089

7090 - `claude_tag_user_id: string or null`

7091

7092 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.

68717093

68727094 - `context_window: "0-200k" or "200k-1M" or null`

68737095

from line 7211

69897211 "results": [

69907212 {

69917213 "amount": "amount",

7214 "claude_tag_category": "dm",

7215 "claude_tag_user_id": "U0123ABCDEF",

69927216 "context_window": "0-200k",

69937217 "cost_type": "code_execution",

69947218 "currency": "USD",

from line 7269

70457269

70467270 - `"1m"`

70477271

7272- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`

7273

7274 Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.

7275

7276 maxItems: 100

7277

7278 - `"dm"`

7279

7280 - `"engaged"`

7281

7282 - `"monitoring"`

7283

7284 - `"proactive"`

7285

7286 - `"scheduled"`

7287

7288- `claude_tag_user_ids: optional array of string`

7289

7290 Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.

7291

7292 maxItems: 100

7293

70487294- `context_windows: optional array of "0-200k" or "200k-1M"`

70497295

70507296 Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.

from line 7313

70677313

70687314 default: false

70697315

7070- `group_by: optional array of "context_window" or "cost_type" or "inference_geo" or 6 more`

7316- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 8 more`

70717317

70727318 Break each actor's row out by the given dimensions. Accepts the same values as the bucketed `/cost_report` endpoint. The `product`, `model`, `context_window`, `inference_geo`, and `speed` dimensions — and the time bucket, when `bucket_width` is set — count toward `limit`. `cost_type` and `token_type` do not: `cost_type` returns one row per cost component (tokens, web search, code execution); `token_type` returns one row per token type, each with `cost_type: "tokens"`; combining both returns the per-token-type rows plus the web-search and code-execution rows. A page can therefore contain more rows than `limit` when `cost_type` or `token_type` is requested.

70737319

70747320 maxItems: 100

70757321

7322 - `"claude_tag_category"`

7323

7324 - `"claude_tag_user_id"`

7325

70767326 - `"context_window"`

70777327

70787328 - `"cost_type"`

from line 7472

72227472 - `amount: string`

72237473

72247474 Amount (post-discount, pre-credit) in fractional cents (minor units).

7475

7476 - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`

7477

7478 Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.

7479

7480 - `"dm"`

7481

7482 - `"engaged"`

7483

7484 - `"monitoring"`

7485

7486 - `"proactive"`

7487

7488 - `"scheduled"`

7489

7490 - `claude_tag_user_id: string or null`

7491

7492 Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.

72257493

72267494 - `context_window: "0-200k" or "200k-1M" or null`

72277495

from line 7621

73537621 "user_id": "user_01AbCdEfGhIjKlMnOpQrSt"

73547622 },

73557623 "amount": "41280.000000",

7624 "claude_tag_category": "dm",

7625 "claude_tag_user_id": "U0123ABCDEF",

73567626 "context_window": "0-200k",

73577627 "cost_type": "code_execution",

73587628 "currency": "USD",

from line 8365

80958365

80968366 - `skill_display_name: optional string or null`

80978367

8098 Human-readable display name for rows whose `skill_name` is an opaque skill id (user/organization skill types — user-defined names are withheld from the analytics pipeline). Only organization-shared skills resolve; the literal 'unknown' bucket row also gets a fixed 'Unknown skill' label. Null for private (user-defined) skills — their names are not disclosed to analytics-key holders — and null when `skill_name` is already a display name, when the skill was deleted, or when display-name resolution is not enabled for this organization.

8368 Human-readable display name for rows whose `skill_name` is an opaque skill id (user/organization skill types and plugin-delivered skills — user-defined names are withheld from the analytics pipeline). Organization-shared skills and skills delivered by the organization's own plugins (its plugin marketplaces and its library) resolve; plugin skill names are shown without their 'plugin:' prefix. The literal 'unknown' bucket row gets a fixed 'Unknown skill' label. Null for private (user-defined) skills and members' personal-plugin skills — those names are not disclosed to analytics-key holders — and for Anthropic-provided plugin skills (not resolved), and null when `skill_name` is already a display name, when the skill or plugin was deleted, or when display-name resolution is not enabled for this organization.

80998369

81008370 - `user_id: optional string or null`

81018371

from line 9301

90319301curl https://api.anthropic.com/v1/organizations/spend_limits \

90329302 -H 'Content-Type: application/json' \

90339303 -H 'anthropic-version: 2023-06-01' \

9034 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

9304 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

90359305 -d '{

90369306 "amount": "50000",

90379307 "scope": {

from line 9441

91719441```bash

91729442curl https://api.anthropic.com/v1/organizations/spend_limits/$SPEND_LIMIT_ID \

91739443 -H 'anthropic-version: 2023-06-01' \

9174 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

9444 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

91759445```

91769446

91779447##### Response (200)

from line 9492

92229492curl https://api.anthropic.com/v1/organizations/spend_limits/$SPEND_LIMIT_ID \

92239493 -X DELETE \

92249494 -H 'anthropic-version: 2023-06-01' \

9225 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

9495 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

92269496```

92279497

92289498##### Response (200)

from line 9671

94019671```bash

94029672curl https://api.anthropic.com/v1/organizations/spend_limits/effective \

94039673 -H 'anthropic-version: 2023-06-01' \

9404 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

9674 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

94059675```

94069676

94079677##### Response (200)

from line 9978

97089978```bash

97099979curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests \

97109980 -H 'anthropic-version: 2023-06-01' \

9711 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

9981 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

97129982```

97139983

97149984##### Response (200)

from line 10285

1001510285```bash

1001610286curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$SPEND_LIMIT_INCREASE_REQUEST_ID \

1001710287 -H 'anthropic-version: 2023-06-01' \

10018 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

10288 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1001910289```

1002010290

1002110291##### Response (200)

from line 10696

1042610696curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$SPEND_LIMIT_INCREASE_REQUEST_ID/approve \

1042710697 -H 'Content-Type: application/json' \

1042810698 -H 'anthropic-version: 2023-06-01' \

10429 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

10699 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

1043010700 -d '{

1043110701 "amount": "50000",

1043210702 "period": "monthly"

from line 11020

1075011020curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$SPEND_LIMIT_INCREASE_REQUEST_ID/deny \

1075111021 -H 'Content-Type: application/json' \

1075211022 -H 'anthropic-version: 2023-06-01' \

10753 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

11023 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

1075411024 -d '{}'

1075511025```

1075611026

from line 11085

1081511085or an API-surface category such as the Files API or Message Batches)

1081611086and contains the set of limiter values that apply to it.

1081711087

11088When `limit` is omitted, every matching entry is returned in a single

11089page; when `limit` truncates the result, follow `next_page` to fetch

11090the remaining entries.

11091

1081811092#### Query parameters

1081911093

1082011094- `group_type: optional "batch" or "files" or "model_group" or 3 more`

from line 11107

1083311107

1083411108 - `"web_search"`

1083511109

11110- `limit: optional number`

11111

11112 Maximum number of items to return per page. Ranges from `1` to `1000`.

11113

11114 When omitted, every remaining entry is returned in a single page and `next_page` is `null`.

11115

11116 maximum: 1000, minimum: 1

11117

1083611118- `model: optional string`

1083711119

1083811120 Filter to the single entry containing this model. Accepts full model names and aliases. Returns 404 if the model is not found or has no rate limits for this organization.

from line 11173

1089111173

1089211174- `next_page: string or null`

1089311175

10894 Token to provide in as `page` in the subsequent request to retrieve the next page of data.

11176 Opaque cursor for the next page of results, or `null` when no entries remain beyond this response.

1089511177

1089611178#### Example

1089711179

1089811180```bash

1089911181curl https://api.anthropic.com/v1/organizations/rate_limits \

1090011182 -H 'anthropic-version: 2023-06-01' \

10901 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

11183 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1090211184```

1090311185

1090411186##### Response (200)

from line 11213

1093111213

1093211214**POST** `/v1/organizations/service_accounts`

1093311215

11216**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

11217

1093411218Create a service account.

1093511219

1093611220A service account is a named workload identity that federation rules

1093711221target. `organization_role` is `developer` (default) or `admin`; a rule

1093811222may only be created or retargeted to grant `org:admin` scope when the

10939target's `organization_role` is `admin`. Requires an OAuth bearer (user

10940or WIF-minted service account token) or a Console session; Admin API

10941keys are not accepted. Creating an `admin`-role service account requires

10942an interactive credential (a user OAuth token or a Console session) — a

10943workload may only create `developer`-role service accounts.

11223target's `organization_role` is `admin`. Creating an `admin`-role service

11224account requires an interactive credential (a user OAuth token or a

11225Console session) — a workload may only create `developer`-role service

11226accounts.

1094411227

1094511228#### Headers

1094611229

from line 11324

1104111324curl https://api.anthropic.com/v1/organizations/service_accounts \

1104211325 -H 'Content-Type: application/json' \

1104311326 -H 'anthropic-version: 2023-06-01' \

11044 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

11327 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

1104511328 -d '{

1104611329 "name": "ci-deploy-bot"

1104711330 }'

from line 11352

1106911352

1107011353**GET** `/v1/organizations/service_accounts/{service_account_id}`

1107111354

11355**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

11356

1107211357Retrieve a service account by its ID (`svac_...`).

1107311358

1107411359#### Path parameters

from line 11438

1115311438```bash

1115411439curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID \

1115511440 -H 'anthropic-version: 2023-06-01' \

11156 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

11441 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1115711442```

1115811443

1115911444##### Response (200)

from line 11463

1117811463

1117911464**GET** `/v1/organizations/service_accounts`

1118011465

11466**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

11467

1118111468List service accounts in the caller's organization.

1118211469

1118311470Results are ordered by creation time, newest first. Use `limit` and the

from line 11564

1127711564```bash

1127811565curl https://api.anthropic.com/v1/organizations/service_accounts \

1127911566 -H 'anthropic-version: 2023-06-01' \

11280 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

11567 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1128111568```

1128211569

1128311570##### Response (200)

from line 11594

1130711594

1130811595**POST** `/v1/organizations/service_accounts/{service_account_id}`

1130911596

11597**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

11598

1131011599Update a service account.

1131111600

1131211601Only `description` and `organization_role` are mutable; `name` cannot be

1131311602changed. Archived service accounts cannot be updated; this returns 400.

1131411603Setting `organization_role` to `admin` (even when unchanged) requires an

11315interactive credential (a user OAuth token or a Console session). Admin

11316API keys are not accepted.

11604interactive credential (a user OAuth token or a Console session).

1131711605

1131811606#### Path parameters

1131911607

from line 11702

1141411702curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID \

1141511703 -H 'Content-Type: application/json' \

1141611704 -H 'anthropic-version: 2023-06-01' \

11417 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

11705 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

1141811706 -d '{}'

1141911707```

1142011708

from line 11728

1144011728

1144111729**POST** `/v1/organizations/service_accounts/{service_account_id}/archive`

1144211730

11731**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

11732

1144311733Archive a service account.

1144411734

1144511735Idempotent; re-archiving returns the service account with its original

from line 11737

1144711737rule still targets this service account, same as issuer archival; archive

1144811738those rules first or change their target to another service account.

1144911739

11450Requires an OAuth bearer or Console session; Admin API keys are not

11451accepted.

11452

1145311740#### Path parameters

1145411741

1145511742- `service_account_id: string`

from line 11820

1153311820curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/archive \

1153411821 -X POST \

1153511822 -H 'anthropic-version: 2023-06-01' \

11536 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

11823 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1153711824```

1153811825

1153911826##### Response (200)

from line 11847

1156011847

1156111848**POST** `/v1/organizations/service_accounts/{service_account_id}/workspaces`

1156211849

11850**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

11851

1156311852Add a service account to a workspace with the given `workspace_role`.

1156411853

1156511854Mirror of `POST /workspaces/{workspace_id}/service_accounts`, addressed

from line 11856

1156711856service account is already an explicit member of the workspace, its

1156811857`workspace_role` is replaced with the value supplied here. Archived

1156911858workspaces return 400. Archived service accounts cannot be added and are

11570rejected. Requires an OAuth bearer or Console session; Admin API keys

11571are not accepted.

11859rejected.

1157211860

1157311861#### Path parameters

1157411862

from line 11932

1164411932curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/workspaces \

1164511933 -H 'Content-Type: application/json' \

1164611934 -H 'anthropic-version: 2023-06-01' \

11647 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

11935 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

1164811936 -d '{

1164911937 "workspace_id": "workspace_id",

1165011938 "workspace_role": "workspace_admin"

from line 11956

1166811956

1166911957**GET** `/v1/organizations/service_accounts/{service_account_id}/workspaces`

1167011958

11959**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

11960

1167111961List the workspaces a service account is a member of.

1167211962

1167311963Each entry includes the service account's `workspace_role` in that

from line 11967

1167711967the first page; with `limit=1` the first page may return up to 2 entries

1167811968(the implicit entry plus one explicit membership) so a pagination cursor

1167911969can be derived. Memberships are returned only while

11680the service account is active; an archived service account returns an

11681empty list.

11970the service account is active. Without a `page` cursor, an archived

11971service account returns an empty list. A `page` cursor that does not

11972match an active membership returns a 400 invalid-request error. A cursor

11973stops matching when the membership is removed, the workspace is deleted,

11974or the service account is archived. Restart pagination from the first

11975page to recover.

1168211976

1168311977#### Path parameters

1168411978

from line 12047

1175312047```bash

1175412048curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/workspaces \

1175512049 -H 'anthropic-version: 2023-06-01' \

11756 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

12050 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1175712051```

1175812052

1175912053##### Response (200)

from line 12072

1177812072

1177912073**DELETE** `/v1/organizations/service_accounts/{service_account_id}/workspaces/{workspace_id}`

1178012074

12075**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

12076

1178112077Remove a service account from a workspace.

1178212078

1178312079Mirror of `DELETE /workspaces/{workspace_id}/service_accounts/{service_account_id}`,

from line 12082

1178612082implicit default-workspace membership returns 200 but is a no-op and the

1178712083membership persists; deleting an explicit default-workspace row reverts

1178812084to the implicit `workspace_user` membership. Archived workspaces return

11789400. Requires an OAuth bearer or Console session; Admin API keys are not

11790accepted.

12085400.

1179112086

1179212087#### Path parameters

1179312088

from line 12122

1182712122curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/workspaces/$WORKSPACE_ID \

1182812123 -X DELETE \

1182912124 -H 'anthropic-version: 2023-06-01' \

11830 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

12125 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1183112126```

1183212127

1183312128##### Response (200)

from line 12140

1184512140### Create Federation Issuer

1184612141

1184712142**POST** `/v1/organizations/federation_issuers`

12143

12144**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

1184812145

1184912146Register an OIDC issuer that Anthropic will trust for workload identity

1185012147federation in your organization.

from line 12155

1185812155document; for `explicit_url` and `inline` modes the issuer URL is only

1185912156matched as the JWT's `iss` claim and is not fetched.

1186012157

11861Requires an OAuth bearer or Console session; Admin API keys are not

11862accepted.

11863

1186412158#### Headers

1186512159

1186612160- `"anthropic-beta": optional array of string`

from line 12386

1209212386curl https://api.anthropic.com/v1/organizations/federation_issuers \

1209312387 -H 'Content-Type: application/json' \

1209412388 -H 'anthropic-version: 2023-06-01' \

12095 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

12389 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

1209612390 -d '{

1209712391 "issuer_url": "x",

1209812392 "name": "x"

from line 12427

1213312427

1213412428**GET** `/v1/organizations/federation_issuers/{federation_issuer_id}`

1213512429

12430**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

12431

1213612432Retrieve a federation issuer by its ID (`fdis_...`).

1213712433

1213812434#### Path parameters

from line 12593

1229712593```bash

1229812594curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \

1229912595 -H 'anthropic-version: 2023-06-01' \

12300 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

12596 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1230112597```

1230212598

1230312599##### Response (200)

from line 12630

1233412630

1233512631**GET** `/v1/organizations/federation_issuers`

1233612632

12633**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

12634

1233712635List federation issuers in your organization.

1233812636

1233912637Archived issuers are excluded unless `include_archived=true`.

from line 12809

1251112809```bash

1251212810curl https://api.anthropic.com/v1/organizations/federation_issuers \

1251312811 -H 'anthropic-version: 2023-06-01' \

12514 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

12812 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1251512813```

1251612814

1251712815##### Response (200)

from line 12851

1255312851

1255412852**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`

1255512853

12854**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

12855

1255612856Partially update a federation issuer.

1255712857

1255812858Setting `jwks` replaces the full JWKS shape at once. Archived issuers

from line 12860

1256012860

1256112861Updating an issuer that backs a rule with a scope outside

1256212862`workspace:developer` or `workspace:inference` requires a Console

12563session. Requires an OAuth bearer or Console session; Admin API keys

12564are not accepted.

12863session.

1256512864

1256612865#### Path parameters

1256712866

from line 13103

1280413103curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \

1280513104 -H 'Content-Type: application/json' \

1280613105 -H 'anthropic-version: 2023-06-01' \

12807 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

13106 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

1280813107 -d '{}'

1280913108```

1281013109

from line 13141

1284213141

1284313142**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`

1284413143

13144**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

13145

1284513146Archive a federation issuer.

1284613147

1284713148Idempotent; re-archiving returns the issuer with its original

from line 13150

1284913150rule still references the issuer; archive those rules first (a rule's

1285013151issuer cannot be changed), or recreate them against another issuer.

1285113152

12852Requires an OAuth bearer or Console session; Admin API keys are not

12853accepted.

12854

1285513153#### Path parameters

1285613154

1285713155- `federation_issuer_id: string`

from line 13313

1301513313curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID/archive \

1301613314 -X POST \

1301713315 -H 'anthropic-version: 2023-06-01' \

13018 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

13316 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1301913317```

1302013318

1302113319##### Response (200)

from line 13352

1305413352

1305513353**POST** `/v1/organizations/federation_rules`

1305613354

13355**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

13356

1305713357Create a federation rule owned by your organization.

1305813358

1305913359The referenced issuer and the target service account must already exist

from line 13368

1306813368`repo:YOUR_ORG/...`), or a CEL condition referencing one of those

1306913369identity claims (e.g. `claims.repository_owner`). OAuth callers may only

1307013370manage rules whose `oauth_scope` is `workspace:developer` or

13071`workspace:inference`; other scopes require a Console session. Admin API

13072keys are not accepted.

13371`workspace:inference`; other scopes require a Console session.

1307313372

1307413373#### Headers

1307513374

from line 13599

1330013599curl https://api.anthropic.com/v1/organizations/federation_rules \

1330113600 -H 'Content-Type: application/json' \

1330213601 -H 'anthropic-version: 2023-06-01' \

13303 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

13602 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

1330413603 -d '{

1330513604 "issuer_id": "issuer_id",

1330613605 "match": {},

from line 13658

1335913658

1336013659**GET** `/v1/organizations/federation_rules/{federation_rule_id}`

1336113660

13661**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

13662

1336213663Retrieve a federation rule by its ID (`fdrl_...`).

1336313664

1336413665#### Path parameters

from line 13814

1351313814```bash

1351413815curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \

1351513816 -H 'anthropic-version: 2023-06-01' \

13516 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

13817 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1351713818```

1351813819

1351913820##### Response (200)

from line 13863

1356213863

1356313864**GET** `/v1/organizations/federation_rules`

1356413865

13866**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

13867

1356513868List federation rules in your organization.

1356613869

1356713870Optionally filter by issuer with `issuer_id`. Archived rules are excluded

from line 14031

1372814031```bash

1372914032curl https://api.anthropic.com/v1/organizations/federation_rules \

1373014033 -H 'anthropic-version: 2023-06-01' \

13731 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

14034 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1373214035```

1373314036

1373414037##### Response (200)

from line 14085

1378214085

1378314086**POST** `/v1/organizations/federation_rules/{federation_rule_id}`

1378414087

14088**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

14089

1378514090Partially update a federation rule.

1378614091

1378714092`issuer_id` is immutable. `match` and `target` are replaced as whole

from line 14103

1379814103or description change) must also supply a conforming `match` in the same

1379914104request. OAuth callers may only manage rules whose `oauth_scope` is

1380014105`workspace:developer` or `workspace:inference`; other scopes require a

13801Console session. Admin API keys are not accepted.

14106Console session.

1380214107

1380314108#### Path parameters

1380414109

from line 14340

1403514340curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \

1403614341 -H 'Content-Type: application/json' \

1403714342 -H 'anthropic-version: 2023-06-01' \

14038 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

14343 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

1403914344 -d '{}'

1404014345```

1404114346

from line 14390

1408514390

1408614391**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`

1408714392

14393**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

14394

1408814395Archive a federation rule.

1408914396

1409014397Token exchange through this rule stops immediately. Idempotent;

from line 14400

1409314400`workspace_ids` are emptied). Tokens already minted before archive

1409414401remain valid until they expire. OAuth callers may only manage rules

1409514402whose `oauth_scope` is `workspace:developer` or `workspace:inference`;

14096other scopes require a Console session. Admin API keys are not accepted.

14403other scopes require a Console session.

1409714404

1409814405#### Path parameters

1409914406

from line 14555

1424814555curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \

1424914556 -X POST \

1425014557 -H 'anthropic-version: 2023-06-01' \

14251 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

14558 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1425214559```

1425314560

1425414561##### Response (200)

from line 14606

1429914606

1430014607**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`

1430114608

14609**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

14610

1430214611List workspaces where this federation rule is enabled.

1430314612

1430414613Returns all workspace enablements in a single response; the `limit` and

from line 14681

1437214681```bash

1437314682curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \

1437414683 -H 'anthropic-version: 2023-06-01' \

14375 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

14684 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1437614685```

1437714686

1437814687##### Response (200)

from line 14706

1439714706

1439814707**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`

1439914708

14709**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

14710

1440014711Enable a federation rule for a workspace.

1440114712

1440214713Idempotent; re-enabling returns the existing enablement. The rule and

from line 14715

1440414715rule's target service account in this workspace is not checked at

1440514716enablement: token exchange into this workspace is rejected unless the

1440614717target is a member (it is implicitly a member of the default workspace).

14407Archived rules are rejected with 400. OAuth callers may only manage rules whose

14408`oauth_scope` is `workspace:developer` or `workspace:inference`; other

14409scopes require a Console session. Admin API keys are not accepted.

14718Archived rules are rejected with 400. OAuth callers may only manage rules

14719whose `oauth_scope` is `workspace:developer` or `workspace:inference`;

14720other scopes require a Console session.

1441014721

1441114722#### Path parameters

1441214723

from line 14773

1446214773curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \

1446314774 -H 'Content-Type: application/json' \

1446414775 -H 'anthropic-version: 2023-06-01' \

14465 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

14776 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

1446614777 -d '{

1446714778 "workspace_id": "workspace_id"

1446814779 }'

from line 14796

1448514796

1448614797**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`

1448714798

14799**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).

14800

1448814801Disable a federation rule for a workspace.

1448914802

1449014803Idempotent; succeeds even if the enablement was already removed. OAuth

1449114804callers may only manage rules whose `oauth_scope` is

1449214805`workspace:developer` or `workspace:inference`; other scopes require a

14493Console session. Admin API keys are not accepted.

14806Console session.

1449414807

1449514808#### Path parameters

1449614809

from line 14843

1453014843curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \

1453114844 -X DELETE \

1453214845 -H 'anthropic-version: 2023-06-01' \

14533 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

14846 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1453414847```

1453514848

1453614849##### Response (200)

from line 14925

1461214925```bash

1461314926curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID \

1461414927 -H 'anthropic-version: 2023-06-01' \

14615 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

14928 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1461614929```

1461714930

1461814931##### Response (200)

from line 15038

1472515038```bash

1472615039curl https://api.anthropic.com/v1/organizations/tunnels \

1472715040 -H 'anthropic-version: 2023-06-01' \

14728 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

15041 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1472915042```

1473015043

1473115044##### Response (200)

from line 15110

1479715110curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/reveal_token \

1479815111 -X POST \

1479915112 -H 'anthropic-version: 2023-06-01' \

14800 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

15113 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1480115114```

1480215115

1480315116##### Response (200)

from line 15180

1486715180curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/rotate_token \

1486815181 -X POST \

1486915182 -H 'anthropic-version: 2023-06-01' \

14870 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

15183 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1487115184```

1487215185

1487315186##### Response (200)

from line 15266

1495315266curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/archive \

1495415267 -X POST \

1495515268 -H 'anthropic-version: 2023-06-01' \

14956 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

15269 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1495715270```

1495815271

1495915272##### Response (200)

from line 15367

1505415367curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \

1505515368 -H 'Content-Type: application/json' \

1505615369 -H 'anthropic-version: 2023-06-01' \

15057 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \

15370 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \

1505815371 -d '{

1505915372 "ca_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIBexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexa\n...illustrative placeholder, not a real certificate...\n-----END CERTIFICATE-----\n"

1506015373 }'

from line 15458

1514515458```bash

1514615459curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \

1514715460 -H 'anthropic-version: 2023-06-01' \

15148 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

15461 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1514915462```

1515015463

1515115464##### Response (200)

from line 15570

1525715570```bash

1525815571curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \

1525915572 -H 'anthropic-version: 2023-06-01' \

15260 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

15573 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1526115574```

1526215575

1526315576##### Response (200)

from line 15668

1535515668curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \

1535615669 -X POST \

1535715670 -H 'anthropic-version: 2023-06-01' \

15358 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"

15671 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

1535915672```

1536015673

1536115674##### Response (200)

1536215675

This page’s history 6 edits

10 Sep 2026 +0 −15686
4 Sep 2026 +499 −186 · this one
28 Aug 2026 +795 −367
25 Aug 2026 +2775 −6566
21 Aug 2026 +11 −11
14 Aug 2026 +18736 −0

The page’s own history →

Where it came from

The captureapi
Upstream pageplatform.claude.com

Admin changed

The whole hunk