50 pages for permissions.

Permissions Claude Developer Platform · title api/admin/rbac_roles/permissions List RBAC Role Permissions Claude Developer Platform · title api/admin/rbac_roles/permissions/list Permissions Claude Developer Platform · title api/compliance/organizations/roles/permissions List Compliance Role Permissions Claude Developer Platform · title api/compliance/organizations/roles/permissions/list Configure permissions Claude Code CLI · title agent-sdk/permissions Configure permissions Claude Code CLI · title permissions text-editor-tool Claude Developer Platform · in the page agents-and-tools/tool-use/text-editor-tool …before making changes * Handle errors gracefully * Implement permissions checks </Step> <Step title="Process Claude's responses"> Extract and handle tool calls from Claude's response… Admin Claude Developer Platform · in the page api/admin …ted_at": "2024-10-30T23:58:27.427722Z" } ``` ## Admin › RBAC Roles › Permissions ### List RBAC Role Permissions **GET** `/v1/organizations/rbac_roles/{role_id}/permissions` List the permissions an… RBAC Roles Claude Developer Platform · in the page api/admin/rbac_roles …e RBAC Role was last updated. format: date-time ## RBAC Roles › Permissions ### List RBAC Role Permissions **GET** `/v1/organizations/rbac_roles/{role_id}/permissions` List the permissions an… Workspaces Claude Developer Platform · in the page api/admin/workspaces …he service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user… Service Accounts Claude Developer Platform · in the page api/admin/workspaces/service_accounts …he service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user… Create Service Account Workspace Member Claude Developer Platform · in the page api/admin/workspaces/service_accounts/create …he service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user… Organization Claude Developer Platform · in the page api/beta/organization …he service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user… Workspaces Claude Developer Platform · in the page api/beta/organization/workspaces …he service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user… Service Accounts Claude Developer Platform · in the page api/beta/organization/workspaces/service_accounts …he service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user… Create Service Account Workspace Member Claude Developer Platform · in the page api/beta/organization/workspaces/service_accounts/add …he service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user… claude-platform-on-aws-iam-actions Claude Developer Platform · in the page api/claude-platform-on-aws-iam-actions …ic account representative; it is not derived from the principal's IAM permissions. See [Using the Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#using-the… Compliance API Claude Developer Platform · in the page api/compliance …AC custom role. Emitted once per requested permission, including permissions the role already had, so a retried request still produces a complete audit record. - `"rbac_role_permission_rem… Activities Claude Developer Platform · in the page api/compliance/activities …AC custom role. Emitted once per requested permission, including permissions the role already had, so a retried request still produces a complete audit record. - `"rbac_role_permission_rem… Query compliance activities Claude Developer Platform · in the page api/compliance/activities/list …AC custom role. Emitted once per requested permission, including permissions the role already had, so a retried request still produces a complete audit record. - `"rbac_role_permission_rem… Organizations Claude Developer Platform · in the page api/compliance/organizations …d_at": "2025-03-14T09:05:17.456789" } ``` ## Organizations › Roles › Permissions ### List Compliance Role Permissions **GET** `/v1/compliance/organizations/{org_uuid}/roles/{role_id}/permissions`… Roles Claude Developer Platform · in the page api/compliance/organizations/roles …ring or null` Role last-updated timestamp (ISO 8601) ## Roles › Permissions ### List Compliance Role Permissions **GET** `/v1/compliance/organizations/{org_uuid}/roles/{role_id}/permissions`… Settings Claude Developer Platform · in the page api/compliance/organizations/settings …i_integration_sharing_enabled"` - `"claude_code_desktop_bypass_permissions_enabled"` - `"claude_code_desktop_enabled"` - `"claude_code_fast_mode_enabled"` - `"claude_code_m… Get effective organization settings Claude Developer Platform · in the page api/compliance/organizations/settings/retrieve …i_integration_sharing_enabled"` - `"claude_code_desktop_bypass_permissions_enabled"` - `"claude_code_desktop_enabled"` - `"claude_code_fast_mode_enabled"` - `"claude_code_m… claude-in-amazon-bedrock Claude Developer Platform · in the page build-with-claude/claude-in-amazon-bedrock …ames your identity provider (SAML, OIDC, or AWS Identity Center). The permissions policy grants `bedrock-mantle:CreateInference` only on the allowed model ARNs. </Step> <Step title="Developer: au… claude-in-microsoft-foundry Claude Developer Platform · in the page build-with-claude/claude-in-microsoft-foundry …Forbidden` * **Solution:** Your Azure account may lack the necessary permissions. Ensure you have the appropriate Azure RBAC role assigned (for example, **Foundry User** (formerly Azure AI User) or *… claude-on-amazon-bedrock-legacy Claude Developer Platform · in the page build-with-claude/claude-on-amazon-bedrock-legacy …Bedrock without managing AWS credentials, IAM roles, or account-level permissions. The simplest approach is to set the `AWS_BEARER_TOKEN_BEDROCK` environment variable, which each SDK detects automati… mid-conversation-effort-example Claude Developer Platform · in the page build-with-claude/mid-conversation-effort-example …removed on exit. There is no sandbox here: the command runs with the permissions of the process that launched the example. For clarity this example runs each call in a fresh subshell rather than main… mid-conversation-system-messages Claude Developer Platform · in the page build-with-claude/mid-conversation-system-messages …ment-after-tool-results) below. * **Mode switches that grant standing permissions.** A session-level mode can use a mid-conversation system message to grant standing consent to an expensive capability… home Claude Developer Platform · in the page home …ude.com/docs/en/managed-agents/permission-policies"> Tool permissions </HomeJourneyLink> </HomeJourneyStep> <HomeJourneyStep title="Run sessions"> <Hom… admin-api Claude Developer Platform · in the page manage-claude/admin-api …cific workspace, sent in the `x-api-key` header. The key has the same permissions as the linked account. See [Key types](https://platform.claude.com/docs/en/manage-claude/authentication#key-types). </… admin-api-keys Claude Developer Platform · in the page manage-claude/admin-api-keys …**admin** role can create Admin API keys. See [Organization roles and permissions](https://platform.claude.com/docs/en/manage-claude/admin-api#organization-roles-and-permissions). </Step> <Step t… authentication Claude Developer Platform · in the page manage-claude/authentication …- | | **Personal key** | You, the user, with your roles and permissions | Either a single workspace or the workspaces wh… cmek Claude Developer Platform · in the page manage-claude/cmek …de/cmek-aws-kms#claude-platform-on-aws) instead. ## Prerequisites * Permissions to create encryption keys and manage key access in the account, project, or subscription that will host the encryption… cmek-aws-kms Claude Developer Platform · in the page manage-claude/cmek-aws-kms …n the next sections. </Note> ## Prerequisites * An AWS account with permissions to create KMS keys and set key policies (`kms:CreateKey` and `kms:PutKeyPolicy`). * An Anthropic Admin API key for you… cmek-azure-key-vault Claude Developer Platform · in the page manage-claude/cmek-azure-key-vault …K-protected data. Purge protection cannot be disabled once enabled. * Permissions to create keys in the vault and to assign RBAC roles on it. * Permissions to create service principals in your Entra t… cmek-google-cloud-kms Claude Developer Platform · in the page manage-claude/cmek-google-cloud-kms …g enabled. * The Cloud KMS API enabled (`cloudkms.googleapis.com`). * Permissions to create KMS key rings and keys, and to set IAM policy on them (`roles/cloudkms.admin` or equivalent). * An Anthropic… Fetch the first page (newest activities first) and capture its trailing cursor. Claude Developer Platform · in the page manage-claude/compliance-activity-feed …| | Organizations, projects, project attachments, users, roles, role permissions, groups, group members | Endpoint-specific | Page token | `page` (returned as `n… compliance-api Claude Developer Platform · in the page manage-claude/compliance-api …r your organization, then create a Compliance Access Key (with scoped permissions) or an Admin API key, and learn which to use. </Card> <Card href="https://platform.claude.com/docs/en/manage-clau… compliance-api-access Claude Developer Platform · in the page manage-claude/compliance-api-access …r your organization, then create a Compliance Access Key (with scoped permissions) or an Admin API key, and learn which to use. --- <Note> Claude Enterprise organizations and eligible standalone Cl… compliance-errors Claude Developer Platform · in the page manage-claude/compliance-errors …ry, project, and session endpoints (organizations, users, roles, role permissions, groups, group members, projects, project attachments, local and remote sessions, and session messages) paginate with… compliance-org-data Claude Developer Platform · in the page manage-claude/compliance-org-data …les/list) response schema for the full role record shape. To list the permissions currently granted to a role, use [List Compliance Role Permissions](https://platform.claude.com/docs/en/api/compliance… user-management Claude Developer Platform · in the page manage-claude/user-management …ons/rbac_roles/{role_id}` `GET /v1/organizations/rbac_roles/{role_id}/permissions` | Read your organization's custom ro… wif-admin-api Claude Developer Platform · in the page manage-claude/wif-admin-api …nored. There are two ways to obtain a token, and they carry different permissions: a token from your own login acts as a user, whereas a federated token acts as a service account and cannot perform ev… github-actions Claude Developer Platform · in the page manage-claude/wif-providers/github-actions …e `id-token: write` permission at the workflow or job level: ```yaml permissions: id-token: write contents: read ``` Inside the job, the runner exposes two environment variables: `ACTIONS_ID_TOK… wif-reference Claude Developer Platform · in the page manage-claude/wif-reference …ints](https://platform.claude.com/docs/en/manage-claude/wif-admin-api#permissions-and-constraints). | A r… workspaces Claude Developer Platform · in the page manage-claude/workspaces …access resources within that workspace. Some API keys can be granted permissions across multiple workspaces, and provide a [workspace ID header](https://platform.claude.com/docs/en/manage-claude/auth… github Claude Developer Platform · in the page managed-agents/github …o clone the repository. It is not echoed in API responses. See [Token permissions](https://platform.claude.com/docs/en/managed-agents/github#token-permissions). | | `mount_path` | Optional. T… mcp-connector Claude Developer Platform · in the page managed-agents/mcp-connector …or the general `default_config` / `configs` pattern, and [MCP toolset permissions](https://platform.claude.com/docs/en/managed-agents/permission-policies#mcp-toolset-permissions) for setting `permissi… multiagent-orchestration Claude Developer Platform · in the page managed-agents/multiagent-orchestration …_at}" end ``` </CodeGroup> </Tab> </Tabs> ### Tool permissions and custom tools If a subagent needs something from your client, such as [permission](https://platform.claude.com/doc…