The whole hunk
from line 50, old and new numbered
/
lines
from line 50
5050
5151 Geographic region for workspace data storage. Immutable after creation. Defaults to 'us' if omitted.
5252
53- `display_color: optional string or null`
54
55 Hex color code representing the Workspace in the Anthropic Console.
56
57 maxLength: 7, pattern: ^#[0-9A-Fa-f]{6}$
58
5359- `external_key_id: optional string or null`
5460
5561 ID of the customer-managed encryption key (CMEK) configuration to use for this
5662 Workspace. Setting this field requires CMEK to be enabled for your
5763 organization. When set, data stored for this Workspace is encrypted with the
58 referenced key. Create key configurations with the External Keys API. This
59 field is write-once: once a key is attached to a Workspace it cannot be
60 detached or replaced. To rotate key material, rotate the underlying key on
61 your cloud KMS; the `external_key_id` stays the same.
64 referenced key. Create key configurations with the External Keys API. On
65 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
66 single-Region key in the same AWS account and Region as the Workspace. On that
67 platform the key is validated against this Workspace when it is attached, so a
68 key-policy problem is reported as an error on this request. This field is write-once:
69 once a key is attached to a Workspace it cannot be detached or replaced. To
70 rotate key material, rotate the underlying key on your cloud KMS; the
71 `external_key_id` stays the same.
6272
6373- `tags: optional map[string] or null`
6474
from line 94
8494 customer-managed encryption key (CMEK) on AWS, reference this value in your
8595 KMS key-policy condition so the key is scoped to this compartment. On GCP and
8696 Azure, Anthropic enforces the compartment binding automatically; you do not
87 need to reference this value in your key configuration. See the CMEK integration guide for the
88 required key configuration, including the value used during key validation.
97 need to reference this value in your key configuration. See the CMEK
98 integration guide for the required key configuration; unless your organization
99 is on Claude Platform on AWS, it includes a separate value used during key
100 validation. On Claude Platform on AWS there is no separate validation value:
101 the key is validated against this Workspace's own value when it is attached, so
102 if your key policy uses the compartment condition, add this value to it before
103 attaching the key.
89104
90105 - `created_at: string`
91106
from line 137
122137 ID of the customer-managed encryption key (CMEK) configuration to use for this
123138 Workspace. Setting this field requires CMEK to be enabled for your
124139 organization. When set, data stored for this Workspace is encrypted with the
125 referenced key. Create key configurations with the External Keys API. This
126 field is write-once: once a key is attached to a Workspace it cannot be
127 detached or replaced. To rotate key material, rotate the underlying key on
128 your cloud KMS; the `external_key_id` stays the same.
140 referenced key. Create key configurations with the External Keys API. On
141 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
142 single-Region key in the same AWS account and Region as the Workspace. On that
143 platform the key is validated against this Workspace when it is attached, so a
144 key-policy problem is reported as an error on this request. This field is write-once:
145 once a key is attached to a Workspace it cannot be detached or replaced. To
146 rotate key material, rotate the underlying key on your cloud KMS; the
147 `external_key_id` stays the same.
129148
130149 - `name: string`
131150
from line 168
149168curl https://api.anthropic.com/v1/organizations/workspaces \
150169 -H 'Content-Type: application/json' \
151170 -H 'anthropic-version: 2023-06-01' \
152 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
171 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
153172 -d '{
154173 "name": "x",
174 "display_color": "#6C5BB9",
155175 "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
156176 "tags": {
157177 "env": "prod",
from line 236
216236 customer-managed encryption key (CMEK) on AWS, reference this value in your
217237 KMS key-policy condition so the key is scoped to this compartment. On GCP and
218238 Azure, Anthropic enforces the compartment binding automatically; you do not
219 need to reference this value in your key configuration. See the CMEK integration guide for the
220 required key configuration, including the value used during key validation.
239 need to reference this value in your key configuration. See the CMEK
240 integration guide for the required key configuration; unless your organization
241 is on Claude Platform on AWS, it includes a separate value used during key
242 validation. On Claude Platform on AWS there is no separate validation value:
243 the key is validated against this Workspace's own value when it is attached, so
244 if your key policy uses the compartment condition, add this value to it before
245 attaching the key.
221246
222247 - `created_at: string`
223248
from line 279
254279 ID of the customer-managed encryption key (CMEK) configuration to use for this
255280 Workspace. Setting this field requires CMEK to be enabled for your
256281 organization. When set, data stored for this Workspace is encrypted with the
257 referenced key. Create key configurations with the External Keys API. This
258 field is write-once: once a key is attached to a Workspace it cannot be
259 detached or replaced. To rotate key material, rotate the underlying key on
260 your cloud KMS; the `external_key_id` stays the same.
282 referenced key. Create key configurations with the External Keys API. On
283 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
284 single-Region key in the same AWS account and Region as the Workspace. On that
285 platform the key is validated against this Workspace when it is attached, so a
286 key-policy problem is reported as an error on this request. This field is write-once:
287 once a key is attached to a Workspace it cannot be detached or replaced. To
288 rotate key material, rotate the underlying key on your cloud KMS; the
289 `external_key_id` stays the same.
261290
262291 - `name: string`
263292
from line 309
280309```bash
281310curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID \
282311 -H 'anthropic-version: 2023-06-01' \
283 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
312 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
284313```
285314
286315#### Response (200)
from line 386
357386 customer-managed encryption key (CMEK) on AWS, reference this value in your
358387 KMS key-policy condition so the key is scoped to this compartment. On GCP and
359388 Azure, Anthropic enforces the compartment binding automatically; you do not
360 need to reference this value in your key configuration. See the CMEK integration guide for the
361 required key configuration, including the value used during key validation.
389 need to reference this value in your key configuration. See the CMEK
390 integration guide for the required key configuration; unless your organization
391 is on Claude Platform on AWS, it includes a separate value used during key
392 validation. On Claude Platform on AWS there is no separate validation value:
393 the key is validated against this Workspace's own value when it is attached, so
394 if your key policy uses the compartment condition, add this value to it before
395 attaching the key.
362396
363397 - `created_at: string`
364398
from line 429
395429 ID of the customer-managed encryption key (CMEK) configuration to use for this
396430 Workspace. Setting this field requires CMEK to be enabled for your
397431 organization. When set, data stored for this Workspace is encrypted with the
398 referenced key. Create key configurations with the External Keys API. This
399 field is write-once: once a key is attached to a Workspace it cannot be
400 detached or replaced. To rotate key material, rotate the underlying key on
401 your cloud KMS; the `external_key_id` stays the same.
432 referenced key. Create key configurations with the External Keys API. On
433 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
434 single-Region key in the same AWS account and Region as the Workspace. On that
435 platform the key is validated against this Workspace when it is attached, so a
436 key-policy problem is reported as an error on this request. This field is write-once:
437 once a key is attached to a Workspace it cannot be detached or replaced. To
438 rotate key material, rotate the underlying key on your cloud KMS; the
439 `external_key_id` stays the same.
402440
403441 - `name: string`
404442
from line 471
433471```bash
434472curl https://api.anthropic.com/v1/organizations/workspaces \
435473 -H 'anthropic-version: 2023-06-01' \
436 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
474 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
437475```
438476
439477#### Response (200)
from line 541
503541
504542 - `"us"`
505543
544- `display_color: optional string`
545
546 Hex color code representing the Workspace in the Anthropic Console.
547
548 maxLength: 7, pattern: ^#[0-9A-Fa-f]{6}$
549
506550- `external_key_id: optional string`
507551
508552 ID of the customer-managed encryption key (CMEK) configuration to use for this
509553 Workspace. Setting this field requires CMEK to be enabled for your
510554 organization. When set, data stored for this Workspace is encrypted with the
511 referenced key. Create key configurations with the External Keys API. This
512 field is write-once: once a key is attached to a Workspace it cannot be
513 detached or replaced. To rotate key material, rotate the underlying key on
514 your cloud KMS; the `external_key_id` stays the same.
555 referenced key. Create key configurations with the External Keys API. On
556 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
557 single-Region key in the same AWS account and Region as the Workspace. On that
558 platform the key is validated against this Workspace when it is attached, so a
559 key-policy problem is reported as an error on this request. This field is write-once:
560 once a key is attached to a Workspace it cannot be detached or replaced. To
561 rotate key material, rotate the underlying key on your cloud KMS; the
562 `external_key_id` stays the same.
515563
516564- `name: optional string`
517565
from line 591
543591 customer-managed encryption key (CMEK) on AWS, reference this value in your
544592 KMS key-policy condition so the key is scoped to this compartment. On GCP and
545593 Azure, Anthropic enforces the compartment binding automatically; you do not
546 need to reference this value in your key configuration. See the CMEK integration guide for the
547 required key configuration, including the value used during key validation.
594 need to reference this value in your key configuration. See the CMEK
595 integration guide for the required key configuration; unless your organization
596 is on Claude Platform on AWS, it includes a separate value used during key
597 validation. On Claude Platform on AWS there is no separate validation value:
598 the key is validated against this Workspace's own value when it is attached, so
599 if your key policy uses the compartment condition, add this value to it before
600 attaching the key.
548601
549602 - `created_at: string`
550603
from line 634
581634 ID of the customer-managed encryption key (CMEK) configuration to use for this
582635 Workspace. Setting this field requires CMEK to be enabled for your
583636 organization. When set, data stored for this Workspace is encrypted with the
584 referenced key. Create key configurations with the External Keys API. This
585 field is write-once: once a key is attached to a Workspace it cannot be
586 detached or replaced. To rotate key material, rotate the underlying key on
587 your cloud KMS; the `external_key_id` stays the same.
637 referenced key. Create key configurations with the External Keys API. On
638 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
639 single-Region key in the same AWS account and Region as the Workspace. On that
640 platform the key is validated against this Workspace when it is attached, so a
641 key-policy problem is reported as an error on this request. This field is write-once:
642 once a key is attached to a Workspace it cannot be detached or replaced. To
643 rotate key material, rotate the underlying key on your cloud KMS; the
644 `external_key_id` stays the same.
588645
589646 - `name: string`
590647
from line 665
608665curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID \
609666 -H 'Content-Type: application/json' \
610667 -H 'anthropic-version: 2023-06-01' \
611 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
668 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
612669 -d '{
670 "display_color": "#6C5BB9",
613671 "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
614672 "tags": {
615673 "env": "prod",
from line 730
672730 customer-managed encryption key (CMEK) on AWS, reference this value in your
673731 KMS key-policy condition so the key is scoped to this compartment. On GCP and
674732 Azure, Anthropic enforces the compartment binding automatically; you do not
675 need to reference this value in your key configuration. See the CMEK integration guide for the
676 required key configuration, including the value used during key validation.
733 need to reference this value in your key configuration. See the CMEK
734 integration guide for the required key configuration; unless your organization
735 is on Claude Platform on AWS, it includes a separate value used during key
736 validation. On Claude Platform on AWS there is no separate validation value:
737 the key is validated against this Workspace's own value when it is attached, so
738 if your key policy uses the compartment condition, add this value to it before
739 attaching the key.
677740
678741 - `created_at: string`
679742
from line 773
710773 ID of the customer-managed encryption key (CMEK) configuration to use for this
711774 Workspace. Setting this field requires CMEK to be enabled for your
712775 organization. When set, data stored for this Workspace is encrypted with the
713 referenced key. Create key configurations with the External Keys API. This
714 field is write-once: once a key is attached to a Workspace it cannot be
715 detached or replaced. To rotate key material, rotate the underlying key on
716 your cloud KMS; the `external_key_id` stays the same.
776 referenced key. Create key configurations with the External Keys API. On
777 Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
778 single-Region key in the same AWS account and Region as the Workspace. On that
779 platform the key is validated against this Workspace when it is attached, so a
780 key-policy problem is reported as an error on this request. This field is write-once:
781 once a key is attached to a Workspace it cannot be detached or replaced. To
782 rotate key material, rotate the underlying key on your cloud KMS; the
783 `external_key_id` stays the same.
717784
718785 - `name: string`
719786
from line 804
737804curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/archive \
738805 -X POST \
739806 -H 'anthropic-version: 2023-06-01' \
740 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
807 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
741808```
742809
743810#### Response (200)
from line 903
836903curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members \
837904 -H 'Content-Type: application/json' \
838905 -H 'anthropic-version: 2023-06-01' \
839 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
906 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
840907 -d '{
841908 "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
842909 "workspace_role": "workspace_admin"
from line 976
909976```bash
910977curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members/$USER_ID \
911978 -H 'anthropic-version: 2023-06-01' \
912 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
979 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
913980```
914981
915982##### Response (200)
from line 1071
10041071```bash
10051072curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members \
10061073 -H 'anthropic-version: 2023-06-01' \
1007 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1074 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
10081075```
10091076
10101077##### Response (200)
from line 1164
10971164curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members/$USER_ID \
10981165 -H 'Content-Type: application/json' \
10991166 -H 'anthropic-version: 2023-06-01' \
1100 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
1167 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
11011168 -d '{
11021169 "workspace_role": "workspace_admin"
11031170 }'
from line 1221
11541221curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members/$USER_ID \
11551222 -X DELETE \
11561223 -H 'anthropic-version: 2023-06-01' \
1157 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1224 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
11581225```
11591226
11601227##### Response (200)
from line 1246
11791246override. Groups without overrides inherit the organization limits and
11801247are not listed; use `GET /v1/organizations/rate_limits` to see those.
11811248
1249When `limit` is omitted, every matching entry is returned in a single
1250page; when `limit` truncates the result, follow `next_page` to fetch
1251the remaining entries.
1252
11821253#### Path parameters
11831254
11841255- `workspace_id: string`
from line 1274
12031274
12041275 - `"web_search"`
12051276
1277- `limit: optional number`
1278
1279 Maximum number of items to return per page. Ranges from `1` to `1000`.
1280
1281 When omitted, every remaining entry is returned in a single page and `next_page` is `null`.
1282
1283 maximum: 1000, minimum: 1
1284
12061285- `page: optional string`
12071286
12081287 Opaque cursor from a previous response's `next_page`.
from line 1344
12651344
12661345- `next_page: string or null`
12671346
1268 Token to provide in as `page` in the subsequent request to retrieve the next page of data.
1347 Opaque cursor for the next page of results, or `null` when no entries remain beyond this response.
12691348
12701349#### Example
12711350
from line 1351
12721351```bash
12731352curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/rate_limits \
12741353 -H 'anthropic-version: 2023-06-01' \
1275 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1354 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
12761355```
12771356
12781357##### Response (200)
from line 1386
13071386
13081387**POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts`
13091388
1389**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1390
13101391Add a service account to a workspace with the given `workspace_role`.
13111392
13121393The role determines what the service account can do in the workspace and
from line 1397
13161397assigns a chosen role. If the service account is already an explicit
13171398member of the workspace, its `workspace_role` is replaced with the
13181399value supplied here. Archived workspaces return 400. Archived service
1319accounts cannot be added and are rejected. Requires an OAuth bearer or
1320Console session; Admin API keys are not accepted.
1400accounts cannot be added and are rejected.
13211401
13221402#### Path parameters
13231403
from line 1473
13931473curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts \
13941474 -H 'Content-Type: application/json' \
13951475 -H 'anthropic-version: 2023-06-01' \
1396 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
1476 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
13971477 -d '{
13981478 "service_account_id": "service_account_id",
13991479 "workspace_role": "workspace_admin"
from line 1497
14171497
14181498**GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`
14191499
1500**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1501
14201502Retrieve a service account's membership in a workspace.
14211503
14221504Returns the membership record, including the service account's
from line 1567
14851567```bash
14861568curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \
14871569 -H 'anthropic-version: 2023-06-01' \
1488 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1570 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
14891571```
14901572
14911573##### Response (200)
from line 1587
15051587
15061588**GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts`
15071589
1590**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1591
15081592List the service accounts that are members of a workspace.
15091593
15101594Each entry includes the service account's `workspace_role`. Use `limit`
from line 1671
15871671```bash
15881672curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts \
15891673 -H 'anthropic-version: 2023-06-01' \
1590 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1674 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
15911675```
15921676
15931677##### Response (200)
from line 1696
16121696
16131697**POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`
16141698
1699**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1700
16151701Change a service account's role in a workspace.
16161702
16171703The new `workspace_role` replaces the current one. Only explicit
from line 1705
16191705default-workspace membership, add the service account explicitly with
16201706`POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces
16211707return 400. Archived service accounts cannot be updated and are
1622rejected. Requires an OAuth bearer or Console session; Admin API keys
1623are not accepted.
1708rejected.
16241709
16251710#### Path parameters
16261711
from line 1781
16961781curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \
16971782 -H 'Content-Type: application/json' \
16981783 -H 'anthropic-version: 2023-06-01' \
1699 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
1784 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
17001785 -d '{
17011786 "workspace_role": "workspace_admin"
17021787 }'
from line 1804
17191804
17201805**DELETE** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`
17211806
1807**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).
1808
17221809Remove a service account from a workspace.
17231810
17241811Removal is idempotent (returns 200 even if the membership was already
from line 1812
17251812removed). A DELETE against the implicit default-workspace membership
17261813returns 200 but is a no-op and the membership persists; deleting an
17271814explicit default-workspace row reverts to the implicit `workspace_user`
1728membership. Archived workspaces return 400. Requires an OAuth bearer or
1729Console session; Admin API keys are not accepted.
1815membership. Archived workspaces return 400.
17301816
17311817#### Path parameters
17321818
from line 1852
17661852curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \
17671853 -X DELETE \
17681854 -H 'anthropic-version: 2023-06-01' \
1769 -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN"
1855 -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"
17701856```
17711857
17721858##### Response (200)