The whole hunk
from line 1, old and new numbered
/
lines
from line 1
1---
2title: Federation
3url: https://platform.claude.com/docs/en/api/beta/organization/federation
4---
5
16# Federation
27
38## Federation › Issuers
from line 33
2833
2934 - `string`
3035
31 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
36 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
3237
3338 - `"message-batches-2024-09-24"`
3439
from line 81
7681
7782 - `"user-profiles-2026-08-18"`
7883
84 - `"user-profiles-2026-09-04"`
85
7986 - `"advisor-tool-2026-03-01"`
8087
8188 - `"managed-agents-2026-04-01"`
from line 185
178185
179186 JWKS supplied directly; no network fetch.
180187
188 - `type: "inline"`
189
181190 - `keys: array of map[unknown]`
182191
183192 Inline JWK objects.
from line 193
184193
185194 minItems: 1
186195
187 - `type: "inline"`
188
189196- `max_jwt_lifetime_seconds: optional number or null`
190197
191198 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.
from line 208
201208 Records an external IdP the organization trusts for the RFC 7523
202209 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
203210
211 - `type: "federation_issuer"`
212
213 default: federation_issuer
214
204215 - `id: string`
205216
206217 Tagged ID of the federation issuer.
from line 286
275286
276287 JWKS supplied directly; no network fetch.
277288
289 - `type: "inline"`
290
278291 - `keys: array of map[unknown]`
279292
280293 Inline JWK objects.
from line 294
281294
282295 minItems: 1
283296
284 - `type: "inline"`
285
286297 - `jwks_polling_disabled_at: string or null`
287298
288299 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
from line 332
321332
322333 format: date-time
323334
324 - `type: "federation_issuer"`
325
326 default: federation_issuer
327
328335 - `updated_at: string`
329336
330337 When this issuer was last updated.
from line 421
414421
415422 - `string`
416423
417 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
424 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
418425
419426 - `"message-batches-2024-09-24"`
420427
from line 469
462469
463470 - `"user-profiles-2026-08-18"`
464471
472 - `"user-profiles-2026-09-04"`
473
465474 - `"advisor-tool-2026-03-01"`
466475
467476 - `"managed-agents-2026-04-01"`
from line 517
508517
509518- `data: array of BetaFederationIssuer`
510519
520 - `type: "federation_issuer"`
521
522 default: federation_issuer
523
511524 - `id: string`
512525
513526 Tagged ID of the federation issuer.
from line 595
582595
583596 JWKS supplied directly; no network fetch.
584597
598 - `type: "inline"`
599
585600 - `keys: array of map[unknown]`
586601
587602 Inline JWK objects.
from line 603
588603
589604 minItems: 1
590605
591 - `type: "inline"`
592
593606 - `jwks_polling_disabled_at: string or null`
594607
595608 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
from line 641
628641
629642 format: date-time
630643
631 - `type: "federation_issuer"`
632
633 default: federation_issuer
634
635644 - `updated_at: string`
636645
637646 When this issuer was last updated.
from line 720
711720
712721 - `string`
713722
714 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
723 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
715724
716725 - `"message-batches-2024-09-24"`
717726
from line 768
759768
760769 - `"user-profiles-2026-08-18"`
761770
771 - `"user-profiles-2026-09-04"`
772
762773 - `"advisor-tool-2026-03-01"`
763774
764775 - `"managed-agents-2026-04-01"`
from line 821
810821 Records an external IdP the organization trusts for the RFC 7523
811822 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
812823
824 - `type: "federation_issuer"`
825
826 default: federation_issuer
827
813828 - `id: string`
814829
815830 Tagged ID of the federation issuer.
from line 899
884899
885900 JWKS supplied directly; no network fetch.
886901
902 - `type: "inline"`
903
887904 - `keys: array of map[unknown]`
888905
889906 Inline JWK objects.
from line 907
890907
891908 minItems: 1
892909
893 - `type: "inline"`
894
895910 - `jwks_polling_disabled_at: string or null`
896911
897912 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
from line 945
930945
931946 format: date-time
932947
933 - `type: "federation_issuer"`
934
935 default: federation_issuer
936
937948 - `updated_at: string`
938949
939950 When this issuer was last updated.
from line 1022
10111022
10121023 - `string`
10131024
1014 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
1025 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
10151026
10161027 - `"message-batches-2024-09-24"`
10171028
from line 1070
10591070
10601071 - `"user-profiles-2026-08-18"`
10611072
1073 - `"user-profiles-2026-09-04"`
1074
10621075 - `"advisor-tool-2026-03-01"`
10631076
10641077 - `"managed-agents-2026-04-01"`
from line 1168
11551168
11561169 JWKS supplied directly; no network fetch.
11571170
1171 - `type: "inline"`
1172
11581173 - `keys: array of map[unknown]`
11591174
11601175 Inline JWK objects.
from line 1176
11611176
11621177 minItems: 1
11631178
1164 - `type: "inline"`
1165
11661179- `jwks_polling_disabled: optional boolean or null`
11671180
11681181 Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected.
from line 1201
11881201 Records an external IdP the organization trusts for the RFC 7523
11891202 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
11901203
1204 - `type: "federation_issuer"`
1205
1206 default: federation_issuer
1207
11911208 - `id: string`
11921209
11931210 Tagged ID of the federation issuer.
from line 1279
12621279
12631280 JWKS supplied directly; no network fetch.
12641281
1282 - `type: "inline"`
1283
12651284 - `keys: array of map[unknown]`
12661285
12671286 Inline JWK objects.
from line 1287
12681287
12691288 minItems: 1
12701289
1271 - `type: "inline"`
1272
12731290 - `jwks_polling_disabled_at: string or null`
12741291
12751292 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
from line 1325
13081325
13091326 format: date-time
13101327
1311 - `type: "federation_issuer"`
1312
1313 default: federation_issuer
1314
13151328 - `updated_at: string`
13161329
13171330 When this issuer was last updated.
from line 1402
13891402
13901403 - `string`
13911404
1392 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
1405 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
13931406
13941407 - `"message-batches-2024-09-24"`
13951408
from line 1450
14371450
14381451 - `"user-profiles-2026-08-18"`
14391452
1453 - `"user-profiles-2026-09-04"`
1454
14401455 - `"advisor-tool-2026-03-01"`
14411456
14421457 - `"managed-agents-2026-04-01"`
from line 1503
14881503 Records an external IdP the organization trusts for the RFC 7523
14891504 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.
14901505
1506 - `type: "federation_issuer"`
1507
1508 default: federation_issuer
1509
14911510 - `id: string`
14921511
14931512 Tagged ID of the federation issuer.
from line 1581
15621581
15631582 JWKS supplied directly; no network fetch.
15641583
1584 - `type: "inline"`
1585
15651586 - `keys: array of map[unknown]`
15661587
15671588 Inline JWK objects.
from line 1589
15681589
15691590 minItems: 1
15701591
1571 - `type: "inline"`
1572
15731592 - `jwks_polling_disabled_at: string or null`
15741593
15751594 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.
from line 1627
16081627
16091628 format: date-time
16101629
1611 - `type: "federation_issuer"`
1612
1613 default: federation_issuer
1614
16151630 - `updated_at: string`
16161631
16171632 When this issuer was last updated.
from line 1708
16931708
16941709 - `string`
16951710
1696 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
1711 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
16971712
16981713 - `"message-batches-2024-09-24"`
16991714
from line 1756
17411756
17421757 - `"user-profiles-2026-08-18"`
17431758
1759 - `"user-profiles-2026-09-04"`
1760
17441761 - `"advisor-tool-2026-03-01"`
17451762
17461763 - `"managed-agents-2026-04-01"`
from line 1848
18311848
18321849 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
18331850
1851 - `type: "service_account"`
1852
18341853 - `service_account_id: string`
18351854
18361855 Tagged ID of the service account to mint tokens for.
18371856
1838 - `type: "service_account"`
1839
18401857 - `service_account_name: optional string or null`
18411858
18421859 Service account's display name at read time. Ignored on writes.
from line 1897
18801897 rules carrying only the legacy `workspace_id` binding do not enforce
18811898 this.
18821899
1900 - `type: "federation_rule"`
1901
1902 default: federation_rule
1903
18831904 - `id: string`
18841905
18851906 Tagged ID of the federation rule.
from line 1983
19621983
19631984 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
19641985
1986 - `type: "service_account"`
1987
19651988 - `service_account_id: string`
19661989
19671990 Tagged ID of the service account to mint tokens for.
19681991
1969 - `type: "service_account"`
1970
19711992 - `service_account_name: optional string or null`
19721993
19731994 Service account's display name at read time. Ignored on writes.
from line 1997
19761997
19771998 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
19781999
1979 - `type: "federation_rule"`
1980
1981 default: federation_rule
1982
19832000 - `updated_at: string`
19842001
19852002 When this rule was last updated.
from line 2117
21002117
21012118 - `string`
21022119
2103 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
2120 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
21042121
21052122 - `"message-batches-2024-09-24"`
21062123
from line 2165
21482165
21492166 - `"user-profiles-2026-08-18"`
21502167
2168 - `"user-profiles-2026-09-04"`
2169
21512170 - `"advisor-tool-2026-03-01"`
21522171
21532172 - `"managed-agents-2026-04-01"`
from line 2213
21942213
21952214- `data: array of BetaFederationRule`
21962215
2216 - `type: "federation_rule"`
2217
2218 default: federation_rule
2219
21972220 - `id: string`
21982221
21992222 Tagged ID of the federation rule.
from line 2299
22762299
22772300 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
22782301
2302 - `type: "service_account"`
2303
22792304 - `service_account_id: string`
22802305
22812306 Tagged ID of the service account to mint tokens for.
22822307
2283 - `type: "service_account"`
2284
22852308 - `service_account_name: optional string or null`
22862309
22872310 Service account's display name at read time. Ignored on writes.
from line 2313
22902313
22912314 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
22922315
2293 - `type: "federation_rule"`
2294
2295 default: federation_rule
2296
22972316 - `updated_at: string`
22982317
22992318 When this rule was last updated.
from line 2412
23932412
23942413 - `string`
23952414
2396 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
2415 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
23972416
23982417 - `"message-batches-2024-09-24"`
23992418
from line 2460
24412460
24422461 - `"user-profiles-2026-08-18"`
24432462
2463 - `"user-profiles-2026-09-04"`
2464
24442465 - `"advisor-tool-2026-03-01"`
24452466
24462467 - `"managed-agents-2026-04-01"`
from line 2519
24982519 rules carrying only the legacy `workspace_id` binding do not enforce
24992520 this.
25002521
2522 - `type: "federation_rule"`
2523
2524 default: federation_rule
2525
25012526 - `id: string`
25022527
25032528 Tagged ID of the federation rule.
from line 2605
25802605
25812606 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
25822607
2608 - `type: "service_account"`
2609
25832610 - `service_account_id: string`
25842611
25852612 Tagged ID of the service account to mint tokens for.
25862613
2587 - `type: "service_account"`
2588
25892614 - `service_account_name: optional string or null`
25902615
25912616 Service account's display name at read time. Ignored on writes.
from line 2619
25942619
25952620 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
25962621
2597 - `type: "federation_rule"`
2598
2599 default: federation_rule
2600
26012622 - `updated_at: string`
26022623
26032624 When this rule was last updated.
from line 2725
27042725
27052726 - `string`
27062727
2707 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
2728 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
27082729
27092730 - `"message-batches-2024-09-24"`
27102731
from line 2773
27522773
27532774 - `"user-profiles-2026-08-18"`
27542775
2776 - `"user-profiles-2026-09-04"`
2777
27552778 - `"advisor-tool-2026-03-01"`
27562779
27572780 - `"managed-agents-2026-04-01"`
from line 2879
28562879
28572880 Bind to a fixed service account by ID.
28582881
2882 - `type: "service_account"`
2883
28592884 - `service_account_id: string`
28602885
28612886 Tagged ID of the service account to mint tokens for.
28622887
2863 - `type: "service_account"`
2864
28652888 - `service_account_name: optional string or null`
28662889
28672890 Service account's display name at read time. Ignored on writes.
from line 2914
28912914 rules carrying only the legacy `workspace_id` binding do not enforce
28922915 this.
28932916
2917 - `type: "federation_rule"`
2918
2919 default: federation_rule
2920
28942921 - `id: string`
28952922
28962923 Tagged ID of the federation rule.
from line 3000
29733000
29743001 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
29753002
3003 - `type: "service_account"`
3004
29763005 - `service_account_id: string`
29773006
29783007 Tagged ID of the service account to mint tokens for.
29793008
2980 - `type: "service_account"`
2981
29823009 - `service_account_name: optional string or null`
29833010
29843011 Service account's display name at read time. Ignored on writes.
from line 3014
29873014
29883015 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
29893016
2990 - `type: "federation_rule"`
2991
2992 default: federation_rule
2993
29943017 - `updated_at: string`
29953018
29963019 When this rule was last updated.
from line 3114
30913114
30923115 - `string`
30933116
3094 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
3117 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
30953118
30963119 - `"message-batches-2024-09-24"`
30973120
from line 3162
31393162
31403163 - `"user-profiles-2026-08-18"`
31413164
3165 - `"user-profiles-2026-09-04"`
3166
31423167 - `"advisor-tool-2026-03-01"`
31433168
31443169 - `"managed-agents-2026-04-01"`
from line 3221
31963221 rules carrying only the legacy `workspace_id` binding do not enforce
31973222 this.
31983223
3224 - `type: "federation_rule"`
3225
3226 default: federation_rule
3227
31993228 - `id: string`
32003229
32013230 Tagged ID of the federation rule.
from line 3307
32783307
32793308 Identity that tokens minted via this rule act as. Currently always a `service_account` target.
32803309
3310 - `type: "service_account"`
3311
32813312 - `service_account_id: string`
32823313
32833314 Tagged ID of the service account to mint tokens for.
32843315
3285 - `type: "service_account"`
3286
32873316 - `service_account_name: optional string or null`
32883317
32893318 Service account's display name at read time. Ignored on writes.
from line 3321
32923321
32933322 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.
32943323
3295 - `type: "federation_rule"`
3296
3297 default: federation_rule
3298
32993324 - `updated_at: string`
33003325
33013326 When this rule was last updated.
from line 3423
33983423
33993424 - `string`
34003425
3401 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
3426 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
34023427
34033428 - `"message-batches-2024-09-24"`
34043429
from line 3471
34463471
34473472 - `"user-profiles-2026-08-18"`
34483473
3474 - `"user-profiles-2026-09-04"`
3475
34493476 - `"advisor-tool-2026-03-01"`
34503477
34513478 - `"managed-agents-2026-04-01"`
from line 3525
34983525
34993526- `BetaFederationRuleWorkspace object`
35003527
3528 - `type: "federation_rule_workspace"`
3529
3530 default: federation_rule_workspace
3531
35013532 - `created_at: string`
35023533
35033534 When this workspace was enabled for the rule.
from line 3543
35123543
35133544 Tagged ID of the federation rule.
35143545
3515 - `type: "federation_rule_workspace"`
3516
3517 default: federation_rule_workspace
3518
35193546 - `workspace_id: string`
35203547
35213548 Tagged ID of the workspace this rule is enabled for.
from line 3616
35893616
35903617 - `string`
35913618
3592 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
3619 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
35933620
35943621 - `"message-batches-2024-09-24"`
35953622
from line 3664
36373664
36383665 - `"user-profiles-2026-08-18"`
36393666
3667 - `"user-profiles-2026-09-04"`
3668
36403669 - `"advisor-tool-2026-03-01"`
36413670
36423671 - `"managed-agents-2026-04-01"`
from line 3712
36833712
36843713- `data: array of BetaFederationRuleWorkspace`
36853714
3715 - `type: "federation_rule_workspace"`
3716
3717 default: federation_rule_workspace
3718
36863719 - `created_at: string`
36873720
36883721 When this workspace was enabled for the rule.
from line 3730
36973730
36983731 Tagged ID of the federation rule.
36993732
3700 - `type: "federation_rule_workspace"`
3701
3702 default: federation_rule_workspace
3703
37043733 - `workspace_id: string`
37053734
37063735 Tagged ID of the workspace this rule is enabled for.
from line 3799
37703799
37713800 - `string`
37723801
3773 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 41 more`
3802 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 42 more`
37743803
37753804 - `"message-batches-2024-09-24"`
37763805
from line 3847
38183847
38193848 - `"user-profiles-2026-08-18"`
38203849
3850 - `"user-profiles-2026-09-04"`
3851
38213852 - `"advisor-tool-2026-03-01"`
38223853
38233854 - `"managed-agents-2026-04-01"`
from line 3893
38623893
38633894#### Returns
38643895
3865- `federation_rule_id: string`
3866
3867 Tagged ID of the federation rule.
3868
38693896- `type: "federation_rule_workspace_deleted"`
38703897
38713898 default: federation_rule_workspace_deleted
3899
3900- `federation_rule_id: string`
3901
3902 Tagged ID of the federation rule.
38723903
38733904- `workspace_id: string`
38743905