386 pages for permissions.

Permissions Claude Developer Platform · title api/beta/organization/rbac_roles/permissions List RBAC Role Permissions Claude Developer Platform · title api/beta/organization/rbac_roles/permissions/list Permissions Claude Developer Platform · title api/compliance/organizations/roles/permissions List Compliance Role Permissions Claude Developer Platform · title api/compliance/organizations/roles/permissions/list Configure permissions Claude Code CLI · title agent-sdk/permissions Configure permissions Claude Code CLI · title permissions text-editor-tool Claude Developer Platform · in the page agents-and-tools/tool-use/text-editor-tool …before making changes * Handle errors gracefully * Implement permissions checks </Step> <Step title="Process Claude's responses"> Extract and handle tool calls from Claude's response… RBAC Roles Claude Developer Platform · in the page api/beta/organization/rbac_roles …e RBAC Role was last updated. format: date-time ## RBAC Roles › Permissions ### List RBAC Role Permissions **GET** `/v1/organizations/rbac_roles/{rbac_role_id}/permissions` List the permissio… Workspaces Claude Developer Platform · in the page api/beta/organization/workspaces …he service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user… Service Accounts Claude Developer Platform · in the page api/beta/organization/workspaces/service_accounts …he service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user… Create Service Account Workspace Member Claude Developer Platform · in the page api/beta/organization/workspaces/service_accounts/add …he service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user… claude-platform-on-aws-iam-actions Claude Developer Platform · in the page api/claude-platform-on-aws-iam-actions …ic account representative; it is not derived from the principal's IAM permissions. See [Using the Claude Console](https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws#using-the… Compliance API Claude Developer Platform · in the page api/compliance …AC custom role. Emitted once per requested permission, including permissions the role already had, so a retried request still produces a complete audit record. - `"rbac_role_permission_rem… Activities Claude Developer Platform · in the page api/compliance/activities …AC custom role. Emitted once per requested permission, including permissions the role already had, so a retried request still produces a complete audit record. - `"rbac_role_permission_rem… Query compliance activities Claude Developer Platform · in the page api/compliance/activities/list …AC custom role. Emitted once per requested permission, including permissions the role already had, so a retried request still produces a complete audit record. - `"rbac_role_permission_rem… Organizations Claude Developer Platform · in the page api/compliance/organizations …_at": "2025-03-14T09:05:17.456789Z" } ``` ## Organizations › Roles › Permissions ### List Compliance Role Permissions **GET** `/v1/compliance/organizations/{org_uuid}/roles/{role_id}/permissions`… Roles Claude Developer Platform · in the page api/compliance/organizations/roles …last-updated timestamp (RFC 3339) format: date-time ## Roles › Permissions ### List Compliance Role Permissions **GET** `/v1/compliance/organizations/{org_uuid}/roles/{role_id}/permissions`… Settings Claude Developer Platform · in the page api/compliance/organizations/settings …kill_plugins_scanning_enabled"` - `"claude_code_desktop_bypass_permissions_enabled"` - `"claude_code_desktop_enabled"` - `"claude_code_fast_mode_enabled"` - `"claude_code_m… Get effective organization settings Claude Developer Platform · in the page api/compliance/organizations/settings/retrieve …kill_plugins_scanning_enabled"` - `"claude_code_desktop_bypass_permissions_enabled"` - `"claude_code_desktop_enabled"` - `"claude_code_fast_mode_enabled"` - `"claude_code_m… Organization Claude Developer Platform · in the page api/organization …he service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user… Workspaces Claude Developer Platform · in the page api/organization/workspaces …he service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user… Service Accounts Claude Developer Platform · in the page api/organization/workspaces/service_accounts …he service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user… Create Service Account Workspace Member Claude Developer Platform · in the page api/organization/workspaces/service_accounts/add …he service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user… claude-in-amazon-bedrock Claude Developer Platform · in the page build-with-claude/claude-in-amazon-bedrock …ames your identity provider (SAML, OIDC, or AWS Identity Center). The permissions policy grants `bedrock-mantle:CreateInference` only on the allowed model ARNs. </Step> <Step title="Developer: au… claude-in-microsoft-foundry Claude Developer Platform · in the page build-with-claude/claude-in-microsoft-foundry …rbidden` * **Solution:** Your Azure account might lack the necessary permissions. Ensure you have the appropriate Azure RBAC role assigned (for example, **Foundry User** (formerly Azure AI User) or *… claude-on-amazon-bedrock-legacy Claude Developer Platform · in the page build-with-claude/claude-on-amazon-bedrock-legacy …Bedrock without managing AWS credentials, IAM roles, or account-level permissions. The simplest approach is to set the `AWS_BEARER_TOKEN_BEDROCK` environment variable, which the SDK detects automatic… mid-conversation-effort-example Claude Developer Platform · in the page build-with-claude/mid-conversation-effort-example …removed on exit. There is no sandbox here: the command runs with the permissions of the process that launched the example. For clarity this example runs each call in a fresh subshell rather than main… mid-conversation-system-messages Claude Developer Platform · in the page build-with-claude/mid-conversation-system-messages …#placement-after-tool-results). * **Mode switches that grant standing permissions.** A session-level mode can use a mid-conversation system message to grant standing consent to an expensive capability… home Claude Developer Platform · in the page home …ude.com/docs/en/managed-agents/permission-policies"> Tool permissions </HomeJourneyLink> </HomeJourneyStep> <HomeJourneyStep title="Run sessions"> <Hom… admin-api Claude Developer Platform · in the page manage-claude/admin-api …cific workspace, sent in the `x-api-key` header. The key has the same permissions as the linked account. See [Key types](https://platform.claude.com/docs/en/manage-claude/authentication#key-types). A… admin-api-keys Claude Developer Platform · in the page manage-claude/admin-api-keys …**admin** role can create Admin API keys. See [Organization roles and permissions](https://platform.claude.com/docs/en/manage-claude/admin-api#organization-roles-and-permissions). </Step> <Step t… authentication Claude Developer Platform · in the page manage-claude/authentication …- | | **Personal key** | You, the user, with your roles and permissions | Either a single workspace or the workspaces wh… cmek Claude Developer Platform · in the page manage-claude/cmek …age-claude/cmek-claude-platform-on-aws) instead. ## Prerequisites * Permissions to create encryption keys and manage key access in the account, project, or subscription that will host the encryption… cmek-aws-kms Claude Developer Platform · in the page manage-claude/cmek-aws-kms …orm-on-aws) instead. </Note> ## Prerequisites * An AWS account with permissions to create KMS keys and set key policies (`kms:CreateKey` and `kms:PutKeyPolicy`). * To create the key from the command… cmek-azure-key-vault Claude Developer Platform · in the page manage-claude/cmek-azure-key-vault …ic's key operations, such as `KeyWrap`, `KeyUnwrap`, and `KeyGet`. * Permissions to create keys in the vault and to assign RBAC roles on it. * Permissions to create service principals in your Entra… cmek-claude-platform-on-aws Claude Developer Platform · in the page manage-claude/cmek-claude-platform-on-aws …AWS account that hosts your Claude Platform on AWS organization, with permissions to create KMS keys and set key policies (`kms:CreateKey` and `kms:PutKeyPolicy`). * To create the key from the comman… cmek-google-cloud-kms Claude Developer Platform · in the page manage-claude/cmek-google-cloud-kms …g enabled. * The Cloud KMS API enabled (`cloudkms.googleapis.com`). * Permissions to create KMS key rings and keys, and to set IAM policy on them (`roles/cloudkms.admin` or equivalent). * Cloud KMS Da… Fetch the first page (newest activities first). Claude Developer Platform · in the page manage-claude/compliance-activity-feed …| | Organizations, projects, project attachments, users, roles, role permissions, groups, group members | Endpoint-specific | Page token | `page` (returned as `n… compliance-api Claude Developer Platform · in the page manage-claude/compliance-api …r your organization, then create a Compliance Access Key (with scoped permissions) or an Admin API key, and learn which to use. </Card> <Card href="https://platform.claude.com/docs/en/manage-clau… compliance-api-access Claude Developer Platform · in the page manage-claude/compliance-api-access …r your organization, then create a Compliance Access Key (with scoped permissions) or an Admin API key, and learn which to use. --- <Note> Claude Enterprise organizations and eligible standalone Cl… compliance-errors Claude Developer Platform · in the page manage-claude/compliance-errors …ry, project, and session endpoints (organizations, users, roles, role permissions, groups, group members, projects, project attachments, local and remote sessions, and session messages) paginate with… compliance-org-data Claude Developer Platform · in the page manage-claude/compliance-org-data …les/list) response schema for the full role record shape. To list the permissions currently granted to a role, use [List Compliance Role Permissions](https://platform.claude.com/docs/en/api/compliance… user-management Claude Developer Platform · in the page manage-claude/user-management …{rbac_role_id}`<br />`GET /v1/organizations/rbac_roles/{rbac_role_id}/permissions` | Read your organizat… wif-admin-api Claude Developer Platform · in the page manage-claude/wif-admin-api …nored. There are two ways to obtain a token, and they carry different permissions: a token from your own login acts as a user, whereas a federated token acts as a service account and cannot perform ev… github-actions Claude Developer Platform · in the page manage-claude/wif-providers/github-actions …e `id-token: write` permission at the workflow or job level: ```yaml permissions: id-token: write contents: read ``` Inside the job, the runner exposes two environment variables: `ACTIONS_ID_TOK… wif-reference Claude Developer Platform · in the page manage-claude/wif-reference …cannot update an issuer that backs a rule with any other scope; see [Permissions and constraints](https://platform.claude.com/docs/en/manage-claude/wif-admin-api#permissions-and-constraints).… workspaces Claude Developer Platform · in the page manage-claude/workspaces …illing for the whole organization. </Warning> ## Workspace roles and permissions Members can have different roles in each workspace, allowing fine-grained access control. | Role… events-and-streaming Claude Developer Platform · in the page managed-agents/events-and-streaming …t's blocking events are cross-posted to the primary thread. See [Tool permissions and custom tools](https://platform.claude.com/docs/en/managed-agents/session-threads#tool-permissions-and-custom-tools… github Claude Developer Platform · in the page managed-agents/github …, but `git push` fails. It is not echoed in API responses. See [Token permissions](https://platform.claude.com/docs/en/managed-agents/github#token-permissions). | | `mount_path` (java, php: `mountPath… mcp-connector Claude Developer Platform · in the page managed-agents/mcp-connector …onfig`) / `configs` (csharp, go: `Configs`) pattern, and [MCP toolset permissions](https://platform.claude.com/docs/en/managed-agents/permission-policies#mcp-toolset-permissions) for setting `permissi…