The whole hunk
from line 4, old and new numbered
/
lines
from line 4
44
55**POST** `/v1/organizations/federation_rules`
66
7**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
8
79Create a federation rule owned by your organization.
810
911The referenced issuer and the target service account must already exist
from line 20
1820`repo:YOUR_ORG/...`), or a CEL condition referencing one of those
1921identity claims (e.g. `claims.repository_owner`). OAuth callers may only
2022manage rules whose `oauth_scope` is `workspace:developer` or
21`workspace:inference`; other scopes require a Console session. Admin API
22keys are not accepted.
23`workspace:inference`; other scopes require a Console session.
2324
2425### Headers
2526
from line 251
250251curl https://api.anthropic.com/v1/organizations/federation_rules \
251252 -H 'Content-Type: application/json' \
252253 -H 'anthropic-version: 2023-06-01' \
253 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
254 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
254255 -d '{
255256 "issuer_id": "issuer_id",
256257 "match": {},
from line 310
309310
310311**GET** `/v1/organizations/federation_rules/{federation_rule_id}`
311312
313**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
314
312315Retrieve a federation rule by its ID (`fdrl_...`).
313316
314317### Path parameters
from line 466
463466```bash
464467curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
465468 -H 'anthropic-version: 2023-06-01' \
466 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
469 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
467470```
468471
469472#### Response (200)
from line 515
512515
513516**GET** `/v1/organizations/federation_rules`
514517
518**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
519
515520List federation rules in your organization.
516521
517522Optionally filter by issuer with `issuer_id`. Archived rules are excluded
from line 683
678683```bash
679684curl https://api.anthropic.com/v1/organizations/federation_rules \
680685 -H 'anthropic-version: 2023-06-01' \
681 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
686 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
682687```
683688
684689#### Response (200)
from line 737
732737
733738**POST** `/v1/organizations/federation_rules/{federation_rule_id}`
734739
740**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
741
735742Partially update a federation rule.
736743
737744`issuer_id` is immutable. `match` and `target` are replaced as whole
from line 755
748755or description change) must also supply a conforming `match` in the same
749756request. OAuth callers may only manage rules whose `oauth_scope` is
750757`workspace:developer` or `workspace:inference`; other scopes require a
751Console session. Admin API keys are not accepted.
758Console session.
752759
753760### Path parameters
754761
from line 992
985992curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
986993 -H 'Content-Type: application/json' \
987994 -H 'anthropic-version: 2023-06-01' \
988 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
995 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
989996 -d '{}'
990997```
991998
from line 1042
10351042
10361043**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`
10371044
1045**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1046
10381047Archive a federation rule.
10391048
10401049Token exchange through this rule stops immediately. Idempotent;
from line 1052
10431052`workspace_ids` are emptied). Tokens already minted before archive
10441053remain valid until they expire. OAuth callers may only manage rules
10451054whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
1046other scopes require a Console session. Admin API keys are not accepted.
1055other scopes require a Console session.
10471056
10481057### Path parameters
10491058
from line 1207
11981207curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \
11991208 -X POST \
12001209 -H 'anthropic-version: 2023-06-01' \
1201 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1210 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
12021211```
12031212
12041213#### Response (200)
from line 1393
13841393
13851394**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
13861395
1396**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1397
13871398List workspaces where this federation rule is enabled.
13881399
13891400Returns all workspace enablements in a single response; the `limit` and
from line 1468
14571468```bash
14581469curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
14591470 -H 'anthropic-version: 2023-06-01' \
1460 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1471 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
14611472```
14621473
14631474##### Response (200)
from line 1493
14821493
14831494**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`
14841495
1496**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1497
14851498Enable a federation rule for a workspace.
14861499
14871500Idempotent; re-enabling returns the existing enablement. The rule and
from line 1502
14891502rule's target service account in this workspace is not checked at
14901503enablement: token exchange into this workspace is rejected unless the
14911504target is a member (it is implicitly a member of the default workspace).
1492Archived rules are rejected with 400. OAuth callers may only manage rules whose
1493`oauth_scope` is `workspace:developer` or `workspace:inference`; other
1494scopes require a Console session. Admin API keys are not accepted.
1505Archived rules are rejected with 400. OAuth callers may only manage rules
1506whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
1507other scopes require a Console session.
14951508
14961509#### Path parameters
14971510
from line 1560
15471560curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \
15481561 -H 'Content-Type: application/json' \
15491562 -H 'anthropic-version: 2023-06-01' \
1550 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
1563 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
15511564 -d '{
15521565 "workspace_id": "workspace_id"
15531566 }'
from line 1583
15701583
15711584**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`
15721585
1586**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1587
15731588Disable a federation rule for a workspace.
15741589
15751590Idempotent; succeeds even if the enablement was already removed. OAuth
15761591callers may only manage rules whose `oauth_scope` is
15771592`workspace:developer` or `workspace:inference`; other scopes require a
1578Console session. Admin API keys are not accepted.
1593Console session.
15791594
15801595#### Path parameters
15811596
from line 1630
16151630curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \
16161631 -X DELETE \
16171632 -H 'anthropic-version: 2023-06-01' \
1618 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1633 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
16191634```
16201635
16211636##### Response (200)