spb/doc-api

1---2title: Organization3url: https://platform.claude.com/docs/en/api/beta/organization4---56# Organization78## Get Current Organization910**GET** `/v1/organizations/me`1112Retrieve information about the organization associated with the authenticated API key.1314### Returns1516- `BetaOrganization object`1718  - `type: "organization"`1920    Object type.2122    For Organizations, this is always `"organization"`.2324    default: organization2526  - `id: string`2728    ID of the Organization.2930    format: uuid3132  - `name: string`3334    Name of the Organization.3536### Example3738```bash39curl https://api.anthropic.com/v1/organizations/me \40    -H 'anthropic-version: 2023-06-01' \41    -H "X-Api-Key: $ANTHROPIC_API_KEY"42```4344#### Response (200)4546```json47{48  "id": "12345678-1234-5678-1234-567812345678",49  "name": "Organization Name",50  "type": "organization"51}52```5354## Domain types5556### Beta Organization5758- `BetaOrganization object`5960  - `type: "organization"`6162    Object type.6364    For Organizations, this is always `"organization"`.6566    default: organization6768  - `id: string`6970    ID of the Organization.7172    format: uuid7374  - `name: string`7576    Name of the Organization.7778### Beta Organization Role7980- `BetaOrganizationRole = "admin" or "billing" or "claude_code_user" or 6 more`8182  - `"admin"`8384  - `"billing"`8586  - `"claude_code_user"`8788  - `"developer"`8990  - `"managed"`9192  - `"membership_admin"`9394  - `"owner"`9596  - `"primary_owner"`9798  - `"user"`99100## Organization › API Keys101102### List API Keys103104**GET** `/v1/organizations/api_keys`105106List API Keys107108#### Query parameters109110- `after_id: optional string`111112  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.113114- `before_id: optional string`115116  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.117118- `created_by_user_id: optional string`119120  Filter by the ID of the User who created the object.121122- `limit: optional number`123124  Number of items to return per page.125126  Defaults to `20`. Ranges from `1` to `1000`.127128  default: 20, maximum: 1000, minimum: 1129130- `status: optional "active" or "archived" or "expired" or "inactive"`131132  Filter by API key status.133134  - `"active"`135136  - `"archived"`137138  - `"expired"`139140  - `"inactive"`141142- `workspace_id: optional string`143144  Filter by Workspace ID.145146#### Returns147148- `data: array of BetaAPIKey`149150  - `type: "api_key"`151152    Object type.153154    For API Keys, this is always `"api_key"`.155156    default: api_key157158  - `id: string`159160    ID of the API key.161162  - `created_at: string`163164    RFC 3339 datetime string indicating when the API Key was created.165166    format: date-time167168  - `created_by: BetaAPIKeyCreatedBy or null`169170    The ID and type of the actor that created the API key, or `null` when the171    creator is not recorded (legacy, workload-identity-federated, or172    system-created keys).173174    - `type: "service_account" or "user"`175176      Type of the actor that created the object.177178      - `"service_account"`179180      - `"user"`181182    - `id: string`183184      ID of the actor that created the object.185186  - `expires_at: string or null`187188    RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.189190    format: date-time191192  - `name: string`193194    Name of the API key.195196  - `partial_key_hint: string or null`197198    Partially redacted hint for the API key.199200  - `principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null`201202    The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.203204    - `BetaAPIKeyUserActor object`205206      - `type: "user_actor"`207208        Principal type. Always `"user_actor"` for a User.209210        default: user_actor211212      - `user_id: string`213214        ID of the User the API key acts as.215216    - `BetaAPIKeyServiceAccountActor object`217218      - `type: "service_account_actor"`219220        Principal type. Always `"service_account_actor"` for a Service Account.221222        default: service_account_actor223224      - `service_account_id: string`225226        ID of the Service Account the API key acts as.227228  - `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`229230    Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.231232    - `BetaAPIKeyOrganizationScope object`233234      - `type: "organization"`235236        Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.237238        default: organization239240    - `BetaAPIKeyWorkspaceScope object`241242      - `type: "workspace"`243244        Scope type. Always `"workspace"`: the API key belongs to one Workspace.245246        default: workspace247248      - `workspace_id: string`249250        ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.251252  - `status: "active" or "archived" or "expired" or "inactive"`253254    Status of the API key.255256    - `"active"`257258    - `"archived"`259260    - `"expired"`261262    - `"inactive"`263264  - `workspace_id: string or null`265266    **Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.267268    Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.269270- `first_id: string or null`271272  First ID in the `data` list. Can be used as the `before_id` for the previous page.273274- `has_more: boolean`275276  Indicates if there are more results in the requested page direction.277278- `last_id: string or null`279280  Last ID in the `data` list. Can be used as the `after_id` for the next page.281282#### Example283284```bash285curl https://api.anthropic.com/v1/organizations/api_keys \286    -H 'anthropic-version: 2023-06-01' \287    -H "X-Api-Key: $ANTHROPIC_API_KEY"288```289290##### Response (200)291292```json293{294  "data": [295    {296      "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",297      "created_at": "2024-10-30T23:58:27.427722Z",298      "created_by": {299        "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",300        "type": "user"301      },302      "expires_at": "2024-10-30T23:58:27.427722Z",303      "name": "Developer Key",304      "partial_key_hint": "sk-ant-api03-R2D...igAA",305      "principal": {306        "type": "user_actor",307        "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"308      },309      "scope": {310        "type": "workspace",311        "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"312      },313      "status": "active",314      "type": "api_key",315      "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"316    }317  ],318  "first_id": "first_id",319  "has_more": true,320  "last_id": "last_id"321}322```323324### Retrieve API Key (Admin API)325326**GET** `/v1/organizations/api_keys/{api_key_id}`327328Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to [API keys](https://platform.claude.com/settings/keys) in the Claude Console.329330#### Path parameters331332- `api_key_id: string`333334  ID of the API key.335336#### Returns337338- `BetaAPIKey object`339340  - `type: "api_key"`341342    Object type.343344    For API Keys, this is always `"api_key"`.345346    default: api_key347348  - `id: string`349350    ID of the API key.351352  - `created_at: string`353354    RFC 3339 datetime string indicating when the API Key was created.355356    format: date-time357358  - `created_by: BetaAPIKeyCreatedBy or null`359360    The ID and type of the actor that created the API key, or `null` when the361    creator is not recorded (legacy, workload-identity-federated, or362    system-created keys).363364    - `type: "service_account" or "user"`365366      Type of the actor that created the object.367368      - `"service_account"`369370      - `"user"`371372    - `id: string`373374      ID of the actor that created the object.375376  - `expires_at: string or null`377378    RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.379380    format: date-time381382  - `name: string`383384    Name of the API key.385386  - `partial_key_hint: string or null`387388    Partially redacted hint for the API key.389390  - `principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null`391392    The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.393394    - `BetaAPIKeyUserActor object`395396      - `type: "user_actor"`397398        Principal type. Always `"user_actor"` for a User.399400        default: user_actor401402      - `user_id: string`403404        ID of the User the API key acts as.405406    - `BetaAPIKeyServiceAccountActor object`407408      - `type: "service_account_actor"`409410        Principal type. Always `"service_account_actor"` for a Service Account.411412        default: service_account_actor413414      - `service_account_id: string`415416        ID of the Service Account the API key acts as.417418  - `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`419420    Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.421422    - `BetaAPIKeyOrganizationScope object`423424      - `type: "organization"`425426        Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.427428        default: organization429430    - `BetaAPIKeyWorkspaceScope object`431432      - `type: "workspace"`433434        Scope type. Always `"workspace"`: the API key belongs to one Workspace.435436        default: workspace437438      - `workspace_id: string`439440        ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.441442  - `status: "active" or "archived" or "expired" or "inactive"`443444    Status of the API key.445446    - `"active"`447448    - `"archived"`449450    - `"expired"`451452    - `"inactive"`453454  - `workspace_id: string or null`455456    **Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.457458    Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.459460#### Example461462```bash463curl https://api.anthropic.com/v1/organizations/api_keys/$API_KEY_ID \464    -H 'anthropic-version: 2023-06-01' \465    -H "X-Api-Key: $ANTHROPIC_API_KEY"466```467468##### Response (200)469470```json471{472  "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",473  "created_at": "2024-10-30T23:58:27.427722Z",474  "created_by": {475    "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",476    "type": "user"477  },478  "expires_at": "2024-10-30T23:58:27.427722Z",479  "name": "Developer Key",480  "partial_key_hint": "sk-ant-api03-R2D...igAA",481  "principal": {482    "type": "user_actor",483    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"484  },485  "scope": {486    "type": "workspace",487    "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"488  },489  "status": "active",490  "type": "api_key",491  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"492}493```494495### Update API Key496497**POST** `/v1/organizations/api_keys/{api_key_id}`498499Update API Key500501#### Path parameters502503- `api_key_id: string`504505  ID of the API key.506507#### Body parameters508509- `name: optional string or null`510511  Name of the API key.512513  maxLength: 500, minLength: 1514515- `status: optional "active" or "archived" or "inactive" or null`516517  Status of the API key.518519  - `"active"`520521  - `"archived"`522523  - `"inactive"`524525#### Returns526527- `BetaAPIKey object`528529  - `type: "api_key"`530531    Object type.532533    For API Keys, this is always `"api_key"`.534535    default: api_key536537  - `id: string`538539    ID of the API key.540541  - `created_at: string`542543    RFC 3339 datetime string indicating when the API Key was created.544545    format: date-time546547  - `created_by: BetaAPIKeyCreatedBy or null`548549    The ID and type of the actor that created the API key, or `null` when the550    creator is not recorded (legacy, workload-identity-federated, or551    system-created keys).552553    - `type: "service_account" or "user"`554555      Type of the actor that created the object.556557      - `"service_account"`558559      - `"user"`560561    - `id: string`562563      ID of the actor that created the object.564565  - `expires_at: string or null`566567    RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.568569    format: date-time570571  - `name: string`572573    Name of the API key.574575  - `partial_key_hint: string or null`576577    Partially redacted hint for the API key.578579  - `principal: BetaAPIKeyUserActor or BetaAPIKeyServiceAccountActor or null`580581    The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.582583    - `BetaAPIKeyUserActor object`584585      - `type: "user_actor"`586587        Principal type. Always `"user_actor"` for a User.588589        default: user_actor590591      - `user_id: string`592593        ID of the User the API key acts as.594595    - `BetaAPIKeyServiceAccountActor object`596597      - `type: "service_account_actor"`598599        Principal type. Always `"service_account_actor"` for a Service Account.600601        default: service_account_actor602603      - `service_account_id: string`604605        ID of the Service Account the API key acts as.606607  - `scope: BetaAPIKeyOrganizationScope or BetaAPIKeyWorkspaceScope`608609    Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.610611    - `BetaAPIKeyOrganizationScope object`612613      - `type: "organization"`614615        Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.616617        default: organization618619    - `BetaAPIKeyWorkspaceScope object`620621      - `type: "workspace"`622623        Scope type. Always `"workspace"`: the API key belongs to one Workspace.624625        default: workspace626627      - `workspace_id: string`628629        ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.630631  - `status: "active" or "archived" or "expired" or "inactive"`632633    Status of the API key.634635    - `"active"`636637    - `"archived"`638639    - `"expired"`640641    - `"inactive"`642643  - `workspace_id: string or null`644645    **Deprecated**: Use `scope` instead. `workspace_id` is `null` both for an API key in the default Workspace and for a principal-bound API key that has no Workspace.646647    Deprecated: use `scope` instead. ID of the Workspace associated with the API key, or `null` if the API key belongs to the default Workspace. Also `null` for a principal-bound API key that has no Workspace; `scope` tells the two apart.648649#### Example650651```bash652curl https://api.anthropic.com/v1/organizations/api_keys/$API_KEY_ID \653    -H 'Content-Type: application/json' \654    -H 'anthropic-version: 2023-06-01' \655    -H "X-Api-Key: $ANTHROPIC_API_KEY" \656    -d '{}'657```658659##### Response (200)660661```json662{663  "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",664  "created_at": "2024-10-30T23:58:27.427722Z",665  "created_by": {666    "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",667    "type": "user"668  },669  "expires_at": "2024-10-30T23:58:27.427722Z",670  "name": "Developer Key",671  "partial_key_hint": "sk-ant-api03-R2D...igAA",672  "principal": {673    "type": "user_actor",674    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"675  },676  "scope": {677    "type": "workspace",678    "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"679  },680  "status": "active",681  "type": "api_key",682  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"683}684```685686## Organization › External Keys687688### Create External Key689690**POST** `/v1/organizations/external_keys`691692Create an external key config owned by the caller's organization.693694#### Body parameters695696- `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfigParam`697698  KMS provider identity and auth coordinates.699700  - `BetaAWSExternalKeyConfig object`701702    - `type: "aws"`703704    - `kms_arn: string`705706      Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.707708      maxLength: 2048709710    - `region: optional string or null`711712      AWS region. Derived from `kms_arn` if omitted.713714    - `role_arn: optional string or null`715716      **Deprecated**717718      IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.719720  - `BetaGCPExternalKeyConfig object`721722    - `type: "gcp"`723724    - `key_name: string`725726      Full resource name of the Cloud KMS key.727728  - `BetaAzureExternalKeyConfigParam object`729730    Azure Key Vault provider configuration.731732    - `type: "azure"`733734    - `key_name: string`735736      Name of the key within the vault.737738    - `tenant_id: string`739740      Azure AD tenant ID.741742    - `vault_uri: string`743744      Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.745746    - `client_id: optional string or null`747748      Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.749750- `display_name: optional string or null`751752  Human-friendly display name.753754  maxLength: 255, minLength: 1755756- `geo: optional "us"`757758  Data residency geo. Only `us` is supported.759760#### Returns761762- `BetaExternalKey object`763764  CMEK external key config belonging to the caller's organization.765766  Configs are organization-scoped. Workspaces attach to a config; once any767  workspace references it, the provider fields become effectively immutable768  (existing encrypted data needs the config for decrypt).769770  - `type: "external_key"`771772    default: external_key773774  - `id: string`775776    Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.777778  - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`779780    Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.781782    - `BetaExternalKeyAttachedAttachment object`783784      - `type: "attached"`785786        default: attached787788    - `BetaExternalKeyUnattachedAttachment object`789790      - `type: "unattached"`791792        default: unattached793794  - `created_at: string`795796    format: date-time797798  - `display_name: string or null`799800    Human-friendly display name. Null if none was set.801802  - `geo: string`803804    Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.805806  - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`807808    KMS provider identity and auth coordinates.809810    - `BetaAWSExternalKeyConfig object`811812      - `type: "aws"`813814      - `kms_arn: string`815816        Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.817818        maxLength: 2048819820      - `region: optional string or null`821822        AWS region. Derived from `kms_arn` if omitted.823824      - `role_arn: optional string or null`825826        **Deprecated**827828        IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.829830    - `BetaGCPExternalKeyConfig object`831832      - `type: "gcp"`833834      - `key_name: string`835836        Full resource name of the Cloud KMS key.837838    - `BetaAzureExternalKeyConfig object`839840      - `type: "azure"`841842      - `key_name: string`843844        Name of the key within the vault.845846      - `tenant_id: string`847848        Azure AD tenant ID.849850      - `vault_uri: string`851852        Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.853854      - `client_id: optional string or null`855856        Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.857858  - `updated_at: string`859860    format: date-time861862#### Example863864```bash865curl https://api.anthropic.com/v1/organizations/external_keys \866    -H 'Content-Type: application/json' \867    -H 'anthropic-version: 2023-06-01' \868    -H "X-Api-Key: $ANTHROPIC_API_KEY" \869    -d '{870          "provider_config": {871            "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",872            "type": "aws"873          }874        }'875```876877##### Response (200)878879```json880{881  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",882  "attachment": {883    "type": "attached"884  },885  "created_at": "2024-10-30T23:58:27.427722Z",886  "display_name": "prod-us-key",887  "geo": "us",888  "provider_config": {889    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",890    "type": "aws",891    "region": "us-east-1",892    "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"893  },894  "type": "external_key",895  "updated_at": "2024-10-30T23:58:27.427722Z"896}897```898899### List External Keys900901**GET** `/v1/organizations/external_keys`902903List external key configs in the caller's organization.904905Results are ordered by creation time (newest first). Use the906`next_page` cursor from the response to fetch subsequent pages.907908#### Query parameters909910- `limit: optional number`911912  Number of results per page.913914  default: 20, maximum: 100, minimum: 1915916- `page: optional string`917918  Opaque cursor from a previous response's `next_page`.919920#### Returns921922- `data: array of BetaExternalKey`923924  - `type: "external_key"`925926    default: external_key927928  - `id: string`929930    Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.931932  - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`933934    Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.935936    - `BetaExternalKeyAttachedAttachment object`937938      - `type: "attached"`939940        default: attached941942    - `BetaExternalKeyUnattachedAttachment object`943944      - `type: "unattached"`945946        default: unattached947948  - `created_at: string`949950    format: date-time951952  - `display_name: string or null`953954    Human-friendly display name. Null if none was set.955956  - `geo: string`957958    Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.959960  - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`961962    KMS provider identity and auth coordinates.963964    - `BetaAWSExternalKeyConfig object`965966      - `type: "aws"`967968      - `kms_arn: string`969970        Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.971972        maxLength: 2048973974      - `region: optional string or null`975976        AWS region. Derived from `kms_arn` if omitted.977978      - `role_arn: optional string or null`979980        **Deprecated**981982        IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.983984    - `BetaGCPExternalKeyConfig object`985986      - `type: "gcp"`987988      - `key_name: string`989990        Full resource name of the Cloud KMS key.991992    - `BetaAzureExternalKeyConfig object`993994      - `type: "azure"`995996      - `key_name: string`997998        Name of the key within the vault.9991000      - `tenant_id: string`10011002        Azure AD tenant ID.10031004      - `vault_uri: string`10051006        Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.10071008      - `client_id: optional string or null`10091010        Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.10111012  - `updated_at: string`10131014    format: date-time10151016- `next_page: string or null`10171018  Opaque cursor for the next page, or null if no more results. Pass as `?page=` to fetch the next page.10191020#### Example10211022```bash1023curl https://api.anthropic.com/v1/organizations/external_keys \1024    -H 'anthropic-version: 2023-06-01' \1025    -H "X-Api-Key: $ANTHROPIC_API_KEY"1026```10271028##### Response (200)10291030```json1031{1032  "data": [1033    {1034      "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",1035      "attachment": {1036        "type": "attached"1037      },1038      "created_at": "2024-10-30T23:58:27.427722Z",1039      "display_name": "prod-us-key",1040      "geo": "us",1041      "provider_config": {1042        "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",1043        "type": "aws",1044        "region": "us-east-1",1045        "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"1046      },1047      "type": "external_key",1048      "updated_at": "2024-10-30T23:58:27.427722Z"1049    }1050  ],1051  "next_page": "next_page"1052}1053```10541055### Get External Key10561057**GET** `/v1/organizations/external_keys/{external_key_id}`10581059Retrieve a single external key config in the caller's organization by ID.10601061#### Path parameters10621063- `external_key_id: string`10641065  ID of the External Key.10661067  maxLength: 204810681069#### Returns10701071- `BetaExternalKey object`10721073  CMEK external key config belonging to the caller's organization.10741075  Configs are organization-scoped. Workspaces attach to a config; once any1076  workspace references it, the provider fields become effectively immutable1077  (existing encrypted data needs the config for decrypt).10781079  - `type: "external_key"`10801081    default: external_key10821083  - `id: string`10841085    Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.10861087  - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`10881089    Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.10901091    - `BetaExternalKeyAttachedAttachment object`10921093      - `type: "attached"`10941095        default: attached10961097    - `BetaExternalKeyUnattachedAttachment object`10981099      - `type: "unattached"`11001101        default: unattached11021103  - `created_at: string`11041105    format: date-time11061107  - `display_name: string or null`11081109    Human-friendly display name. Null if none was set.11101111  - `geo: string`11121113    Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.11141115  - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`11161117    KMS provider identity and auth coordinates.11181119    - `BetaAWSExternalKeyConfig object`11201121      - `type: "aws"`11221123      - `kms_arn: string`11241125        Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.11261127        maxLength: 204811281129      - `region: optional string or null`11301131        AWS region. Derived from `kms_arn` if omitted.11321133      - `role_arn: optional string or null`11341135        **Deprecated**11361137        IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.11381139    - `BetaGCPExternalKeyConfig object`11401141      - `type: "gcp"`11421143      - `key_name: string`11441145        Full resource name of the Cloud KMS key.11461147    - `BetaAzureExternalKeyConfig object`11481149      - `type: "azure"`11501151      - `key_name: string`11521153        Name of the key within the vault.11541155      - `tenant_id: string`11561157        Azure AD tenant ID.11581159      - `vault_uri: string`11601161        Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.11621163      - `client_id: optional string or null`11641165        Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.11661167  - `updated_at: string`11681169    format: date-time11701171#### Example11721173```bash1174curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \1175    -H 'anthropic-version: 2023-06-01' \1176    -H "X-Api-Key: $ANTHROPIC_API_KEY"1177```11781179##### Response (200)11801181```json1182{1183  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",1184  "attachment": {1185    "type": "attached"1186  },1187  "created_at": "2024-10-30T23:58:27.427722Z",1188  "display_name": "prod-us-key",1189  "geo": "us",1190  "provider_config": {1191    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",1192    "type": "aws",1193    "region": "us-east-1",1194    "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"1195  },1196  "type": "external_key",1197  "updated_at": "2024-10-30T23:58:27.427722Z"1198}1199```12001201### Update External Key12021203**POST** `/v1/organizations/external_keys/{external_key_id}`12041205Partially update an external key config. Omitted fields are left unchanged.12061207`display_name` is always editable. `geo` and `provider_config` cannot1208be changed once any workspace references this config, because previously1209encrypted data requires the original key identity to decrypt.12101211#### Path parameters12121213- `external_key_id: string`12141215  ID of the External Key.12161217  maxLength: 204812181219#### Body parameters12201221- `display_name: optional string or null`12221223  Human-friendly display name.12241225  maxLength: 255, minLength: 112261227- `geo: optional "us" or null`12281229  Data residency geo. Only `us` is supported.12301231- `provider_config: optional BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfigParam or null`12321233  KMS provider identity and auth coordinates.12341235  - `BetaAWSExternalKeyConfig object`12361237    - `type: "aws"`12381239    - `kms_arn: string`12401241      Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.12421243      maxLength: 204812441245    - `region: optional string or null`12461247      AWS region. Derived from `kms_arn` if omitted.12481249    - `role_arn: optional string or null`12501251      **Deprecated**12521253      IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.12541255  - `BetaGCPExternalKeyConfig object`12561257    - `type: "gcp"`12581259    - `key_name: string`12601261      Full resource name of the Cloud KMS key.12621263  - `BetaAzureExternalKeyConfigParam object`12641265    Azure Key Vault provider configuration.12661267    - `type: "azure"`12681269    - `key_name: string`12701271      Name of the key within the vault.12721273    - `tenant_id: string`12741275      Azure AD tenant ID.12761277    - `vault_uri: string`12781279      Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.12801281    - `client_id: optional string or null`12821283      Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.12841285#### Returns12861287- `BetaExternalKey object`12881289  CMEK external key config belonging to the caller's organization.12901291  Configs are organization-scoped. Workspaces attach to a config; once any1292  workspace references it, the provider fields become effectively immutable1293  (existing encrypted data needs the config for decrypt).12941295  - `type: "external_key"`12961297    default: external_key12981299  - `id: string`13001301    Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.13021303  - `attachment: BetaExternalKeyAttachedAttachment or BetaExternalKeyUnattachedAttachment`13041305    Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.13061307    - `BetaExternalKeyAttachedAttachment object`13081309      - `type: "attached"`13101311        default: attached13121313    - `BetaExternalKeyUnattachedAttachment object`13141315      - `type: "unattached"`13161317        default: unattached13181319  - `created_at: string`13201321    format: date-time13221323  - `display_name: string or null`13241325    Human-friendly display name. Null if none was set.13261327  - `geo: string`13281329    Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.13301331  - `provider_config: BetaAWSExternalKeyConfig or BetaGCPExternalKeyConfig or BetaAzureExternalKeyConfig`13321333    KMS provider identity and auth coordinates.13341335    - `BetaAWSExternalKeyConfig object`13361337      - `type: "aws"`13381339      - `kms_arn: string`13401341        Full ARN of the AWS KMS key. On Claude Platform on AWS the key must be a single-Region key in your organization's own AWS account; cross-account keys, multi-Region keys, and alias ARNs are rejected.13421343        maxLength: 204813441345      - `region: optional string or null`13461347        AWS region. Derived from `kms_arn` if omitted.13481349      - `role_arn: optional string or null`13501351        **Deprecated**13521353        IAM role ARN. Deprecated — Anthropic reaches the KMS key through its own intermediate role (or, on Claude Platform on AWS, with credentials AWS issues for the Workspace); this field is ignored.13541355    - `BetaGCPExternalKeyConfig object`13561357      - `type: "gcp"`13581359      - `key_name: string`13601361        Full resource name of the Cloud KMS key.13621363    - `BetaAzureExternalKeyConfig object`13641365      - `type: "azure"`13661367      - `key_name: string`13681369        Name of the key within the vault.13701371      - `tenant_id: string`13721373        Azure AD tenant ID.13741375      - `vault_uri: string`13761377        Key Vault data-plane URI — `https://{vault-name}.vault.azure.net` or `https://{hsm-name}.managedhsm.azure.net`.13781379      - `client_id: optional string or null`13801381        Azure AD application (client) ID. Omit to use Anthropic's multitenant app. Provide only if using a single-tenant app registration in the customer's directory.13821383  - `updated_at: string`13841385    format: date-time13861387#### Example13881389```bash1390curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \1391    -H 'Content-Type: application/json' \1392    -H 'anthropic-version: 2023-06-01' \1393    -H "X-Api-Key: $ANTHROPIC_API_KEY" \1394    -d '{}'1395```13961397##### Response (200)13981399```json1400{1401  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",1402  "attachment": {1403    "type": "attached"1404  },1405  "created_at": "2024-10-30T23:58:27.427722Z",1406  "display_name": "prod-us-key",1407  "geo": "us",1408  "provider_config": {1409    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",1410    "type": "aws",1411    "region": "us-east-1",1412    "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"1413  },1414  "type": "external_key",1415  "updated_at": "2024-10-30T23:58:27.427722Z"1416}1417```14181419### Delete External Key14201421**DELETE** `/v1/organizations/external_keys/{external_key_id}`14221423Delete an external key config.14241425The request is rejected if any workspace still references this config.14261427#### Path parameters14281429- `external_key_id: string`14301431  ID of the External Key.14321433  maxLength: 204814341435#### Returns14361437- `type: "external_key_deleted"`14381439  default: external_key_deleted14401441- `id: string`14421443  ID of the deleted External Key.14441445#### Example14461447```bash1448curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID \1449    -X DELETE \1450    -H 'anthropic-version: 2023-06-01' \1451    -H "X-Api-Key: $ANTHROPIC_API_KEY"1452```14531454##### Response (200)14551456```json1457{1458  "id": "ekey_01AbCdEfGhIjKlMnOpQrStUv",1459  "type": "external_key_deleted"1460}1461```14621463### Validate External Key14641465**POST** `/v1/organizations/external_keys/{external_key_id}/validate`14661467Validate an external key config against the customer's KMS.14681469Anthropic performs an encrypt/decrypt roundtrip against the configured1470KMS key and waits up to 30 seconds for the result. The response status is1471`success` if the roundtrip succeeded, or `failure` with an error1472message if it failed or timed out.14731474#### Path parameters14751476- `external_key_id: string`14771478  ID of the External Key.14791480  maxLength: 204814811482#### Returns14831484- `type: "external_key_validation"`14851486  default: external_key_validation14871488- `error: string or null`14891490  Error message when status is `failure`. Null otherwise.14911492- `status: "failure" or "success"`14931494  `success` — encrypt/decrypt roundtrip succeeded. `failure` — the roundtrip failed or timed out; see `error`.14951496  - `"failure"`14971498  - `"success"`14991500#### Example15011502```bash1503curl https://api.anthropic.com/v1/organizations/external_keys/$EXTERNAL_KEY_ID/validate \1504    -X POST \1505    -H 'anthropic-version: 2023-06-01' \1506    -H "X-Api-Key: $ANTHROPIC_API_KEY"1507```15081509##### Response (200)15101511```json1512{1513  "error": "error",1514  "status": "failure",1515  "type": "external_key_validation"1516}1517```15181519## Organization › Federation › Issuers15201521### Create Federation Issuer15221523**POST** `/v1/organizations/federation_issuers`15241525**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).15261527Register an OIDC issuer that Anthropic will trust for workload identity1528federation in your organization.15291530The `jwks` field controls how the issuer's signing keys are obtained and1531takes one of three shapes selected by `type`: `discovery` (resolve keys1532through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS1533URL), or `inline` (provide a static key set). When `jwks.type` is1534`discovery` and no `discovery_base` is set, the issuer URL must be1535publicly reachable over HTTPS so Anthropic can fetch the discovery1536document; for `explicit_url` and `inline` modes the issuer URL is only1537matched as the JWT's `iss` claim and is not fetched.15381539#### Headers15401541- `"anthropic-beta": optional array of AnthropicBeta`15421543  Optional header to specify the beta version(s) you want to use.15441545  - `string`15461547  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`15481549    - `"message-batches-2024-09-24"`15501551    - `"prompt-caching-2024-07-31"`15521553    - `"computer-use-2024-10-22"`15541555    - `"computer-use-2025-01-24"`15561557    - `"pdfs-2024-09-25"`15581559    - `"token-counting-2024-11-01"`15601561    - `"token-efficient-tools-2025-02-19"`15621563    - `"output-128k-2025-02-19"`15641565    - `"files-api-2025-04-14"`15661567    - `"mcp-client-2025-04-04"`15681569    - `"mcp-client-2025-11-20"`15701571    - `"dev-full-thinking-2025-05-14"`15721573    - `"interleaved-thinking-2025-05-14"`15741575    - `"code-execution-2025-05-22"`15761577    - `"extended-cache-ttl-2025-04-11"`15781579    - `"context-1m-2025-08-07"`15801581    - `"context-management-2025-06-27"`15821583    - `"model-context-window-exceeded-2025-08-26"`15841585    - `"skills-2025-10-02"`15861587    - `"fast-mode-2026-02-01"`15881589    - `"output-300k-2026-03-24"`15901591    - `"user-profiles-2026-03-24"`15921593    - `"user-profiles-2026-08-18"`15941595    - `"user-profiles-2026-09-04"`15961597    - `"advisor-tool-2026-03-01"`15981599    - `"managed-agents-2026-04-01"`16001601    - `"cache-diagnosis-2026-04-07"`16021603    - `"dreaming-2026-04-21"`16041605    - `"thinking-token-count-2026-05-13"`16061607    - `"server-side-fallback-2026-06-01"`16081609    - `"server-side-fallback-2026-07-01"`16101611    - `"fallback-credit-2026-06-01"`16121613    - `"fallback-credit-2026-07-01"`16141615    - `"agent-memory-2026-07-22"`16161617    - `"mid-conversation-tool-changes-2026-07-01"`16181619    - `"compact-2026-01-12"`16201621    - `"computer-use-2025-11-24"`16221623    - `"mcp-tunnels-2026-06-22"`16241625    - `"structured-outputs-2025-11-13"`16261627    - `"task-budgets-2026-03-13"`16281629    - `"thinking-display-updates-2026-08-18"`16301631    - `"ce-user-management-2026-07-13"`16321633    - `"mid-conversation-output-config-2026-07-01"`16341635    - `"thinking-binding-controls-2026-08-01"`16361637    - `"mid-conversation-system-clear-at-2026-08-21"`16381639    - `"compact-2026-09-04"`16401641#### Body parameters16421643- `issuer_url: string`16441645  The `iss` claim value to match against.16461647  minLength: 116481649- `name: string`16501651  Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.16521653  maxLength: 255, minLength: 116541655- `check_jti: optional boolean or null`16561657  Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.16581659- `jwks: optional BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`16601661  How signing keys are obtained. Defaults to OIDC discovery.16621663  - `BetaJWKSDiscovery object`16641665    JWKS via the issuer's OIDC discovery document.16661667    - `type: "discovery"`16681669    - `ca_cert_pem: optional string or null`16701671      Optional custom CA (PEM) for TLS verification of the JWKS fetch.16721673      maxLength: 819216741675    - `discovery_base: optional string or null`16761677      Set when the discovery URL differs from `issuer_url`.16781679  - `BetaJWKSExplicitURL object`16801681    JWKS fetched from a fixed endpoint.16821683    - `type: "explicit_url"`16841685    - `url: string`16861687      JWKS endpoint.16881689      minLength: 116901691    - `ca_cert_pem: optional string or null`16921693      Optional custom CA (PEM) for TLS verification of the JWKS fetch.16941695      maxLength: 819216961697  - `BetaJWKSInline object`16981699    JWKS supplied directly; no network fetch.17001701    - `type: "inline"`17021703    - `keys: array of map[unknown]`17041705      Inline JWK objects.17061707      minItems: 117081709- `max_jwt_lifetime_seconds: optional number or null`17101711  Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.17121713  maximum: 176400, exclusiveMinimum: 017141715#### Returns17161717- `BetaFederationIssuer object`17181719  Registered external OIDC identity provider.17201721  Records an external IdP the organization trusts for the RFC 75231722  jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.17231724  - `type: "federation_issuer"`17251726    default: federation_issuer17271728  - `id: string`17291730    Tagged ID of the federation issuer.17311732  - `archived_at: string or null`17331734    If set, all rules referencing this issuer reject token exchange.17351736    format: date-time17371738  - `archived_by_actor_id: string or null`17391740    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.17411742  - `check_jti: boolean`17431744    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.17451746  - `created_at: string`17471748    When this issuer was created.17491750    format: date-time17511752  - `created_by_actor_id: string or null`17531754    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.17551756  - `issuer_url: string`17571758    The `iss` claim value. Incoming JWTs must match exactly.17591760  - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`17611762    How signing keys are obtained for signature verification.17631764    - `BetaJWKSDiscovery object`17651766      JWKS via the issuer's OIDC discovery document.17671768      - `type: "discovery"`17691770      - `ca_cert_pem: optional string or null`17711772        Optional custom CA (PEM) for TLS verification of the JWKS fetch.17731774        maxLength: 819217751776      - `discovery_base: optional string or null`17771778        Set when the discovery URL differs from `issuer_url`.17791780    - `BetaJWKSExplicitURL object`17811782      JWKS fetched from a fixed endpoint.17831784      - `type: "explicit_url"`17851786      - `url: string`17871788        JWKS endpoint.17891790        minLength: 117911792      - `ca_cert_pem: optional string or null`17931794        Optional custom CA (PEM) for TLS verification of the JWKS fetch.17951796        maxLength: 819217971798    - `BetaJWKSInline object`17991800      JWKS supplied directly; no network fetch.18011802      - `type: "inline"`18031804      - `keys: array of map[unknown]`18051806        Inline JWK objects.18071808        minItems: 118091810  - `jwks_polling_disabled_at: string or null`18111812    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.18131814    format: date-time18151816  - `max_jwt_lifetime_seconds: number`18171818    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.18191820  - `name: string`18211822    Admin-chosen slug identifier.18231824  - `poll_status: BetaFederationIssuerPollStatus or null`18251826    Status of automatic JWKS polling for a federation issuer.18271828    Anthropic periodically fetches the issuer's signing keys in the1829    background. These fields summarize the most recent fetches so the1830    health of the JWKS endpoint can be monitored.18311832    - `consecutive_failures: number`18331834      Consecutive fetch failures since the last success.18351836    - `last_fetched_at: string or null`18371838      When the last successful fetch completed.18391840      format: date-time18411842    - `next_poll_at: string or null`18431844      When the next fetch is scheduled. Null if paused.18451846      format: date-time18471848  - `updated_at: string`18491850    When this issuer was last updated.18511852    format: date-time18531854  - `updated_by_actor_id: string or null`18551856    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.18571858#### Example18591860```bash1861curl https://api.anthropic.com/v1/organizations/federation_issuers \1862    -H 'Content-Type: application/json' \1863    -H 'anthropic-version: 2023-06-01' \1864    -H "X-Api-Key: $ANTHROPIC_API_KEY" \1865    -d '{1866          "issuer_url": "x",1867          "name": "x"1868        }'1869```18701871##### Response (200)18721873```json1874{1875  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",1876  "archived_at": "2019-12-27T18:11:19.117Z",1877  "archived_by_actor_id": "archived_by_actor_id",1878  "check_jti": true,1879  "created_at": "2024-10-30T23:58:27.427722Z",1880  "created_by_actor_id": "created_by_actor_id",1881  "issuer_url": "https://token.actions.githubusercontent.com",1882  "jwks": {1883    "type": "discovery",1884    "ca_cert_pem": "ca_cert_pem",1885    "discovery_base": "discovery_base"1886  },1887  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",1888  "max_jwt_lifetime_seconds": 0,1889  "name": "github-actions",1890  "poll_status": {1891    "consecutive_failures": 0,1892    "last_fetched_at": "2019-12-27T18:11:19.117Z",1893    "next_poll_at": "2019-12-27T18:11:19.117Z"1894  },1895  "type": "federation_issuer",1896  "updated_at": "2024-10-30T23:58:27.427722Z",1897  "updated_by_actor_id": "updated_by_actor_id"1898}1899```19001901### List Federation Issuers19021903**GET** `/v1/organizations/federation_issuers`19041905**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).19061907List federation issuers in your organization.19081909Archived issuers are excluded unless `include_archived=true`.19101911#### Query parameters19121913- `include_archived: optional boolean`19141915  Include archived resources. Defaults to false.19161917  default: false19181919- `limit: optional number`19201921  Number of results per page.19221923  default: 20, maximum: 100, minimum: 119241925- `page: optional string`19261927  Opaque cursor from a previous response's `next_page`.19281929#### Headers19301931- `"anthropic-beta": optional array of AnthropicBeta`19321933  Optional header to specify the beta version(s) you want to use.19341935  - `string`19361937  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`19381939    - `"message-batches-2024-09-24"`19401941    - `"prompt-caching-2024-07-31"`19421943    - `"computer-use-2024-10-22"`19441945    - `"computer-use-2025-01-24"`19461947    - `"pdfs-2024-09-25"`19481949    - `"token-counting-2024-11-01"`19501951    - `"token-efficient-tools-2025-02-19"`19521953    - `"output-128k-2025-02-19"`19541955    - `"files-api-2025-04-14"`19561957    - `"mcp-client-2025-04-04"`19581959    - `"mcp-client-2025-11-20"`19601961    - `"dev-full-thinking-2025-05-14"`19621963    - `"interleaved-thinking-2025-05-14"`19641965    - `"code-execution-2025-05-22"`19661967    - `"extended-cache-ttl-2025-04-11"`19681969    - `"context-1m-2025-08-07"`19701971    - `"context-management-2025-06-27"`19721973    - `"model-context-window-exceeded-2025-08-26"`19741975    - `"skills-2025-10-02"`19761977    - `"fast-mode-2026-02-01"`19781979    - `"output-300k-2026-03-24"`19801981    - `"user-profiles-2026-03-24"`19821983    - `"user-profiles-2026-08-18"`19841985    - `"user-profiles-2026-09-04"`19861987    - `"advisor-tool-2026-03-01"`19881989    - `"managed-agents-2026-04-01"`19901991    - `"cache-diagnosis-2026-04-07"`19921993    - `"dreaming-2026-04-21"`19941995    - `"thinking-token-count-2026-05-13"`19961997    - `"server-side-fallback-2026-06-01"`19981999    - `"server-side-fallback-2026-07-01"`20002001    - `"fallback-credit-2026-06-01"`20022003    - `"fallback-credit-2026-07-01"`20042005    - `"agent-memory-2026-07-22"`20062007    - `"mid-conversation-tool-changes-2026-07-01"`20082009    - `"compact-2026-01-12"`20102011    - `"computer-use-2025-11-24"`20122013    - `"mcp-tunnels-2026-06-22"`20142015    - `"structured-outputs-2025-11-13"`20162017    - `"task-budgets-2026-03-13"`20182019    - `"thinking-display-updates-2026-08-18"`20202021    - `"ce-user-management-2026-07-13"`20222023    - `"mid-conversation-output-config-2026-07-01"`20242025    - `"thinking-binding-controls-2026-08-01"`20262027    - `"mid-conversation-system-clear-at-2026-08-21"`20282029    - `"compact-2026-09-04"`20302031#### Returns20322033- `data: array of BetaFederationIssuer`20342035  - `type: "federation_issuer"`20362037    default: federation_issuer20382039  - `id: string`20402041    Tagged ID of the federation issuer.20422043  - `archived_at: string or null`20442045    If set, all rules referencing this issuer reject token exchange.20462047    format: date-time20482049  - `archived_by_actor_id: string or null`20502051    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.20522053  - `check_jti: boolean`20542055    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.20562057  - `created_at: string`20582059    When this issuer was created.20602061    format: date-time20622063  - `created_by_actor_id: string or null`20642065    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.20662067  - `issuer_url: string`20682069    The `iss` claim value. Incoming JWTs must match exactly.20702071  - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`20722073    How signing keys are obtained for signature verification.20742075    - `BetaJWKSDiscovery object`20762077      JWKS via the issuer's OIDC discovery document.20782079      - `type: "discovery"`20802081      - `ca_cert_pem: optional string or null`20822083        Optional custom CA (PEM) for TLS verification of the JWKS fetch.20842085        maxLength: 819220862087      - `discovery_base: optional string or null`20882089        Set when the discovery URL differs from `issuer_url`.20902091    - `BetaJWKSExplicitURL object`20922093      JWKS fetched from a fixed endpoint.20942095      - `type: "explicit_url"`20962097      - `url: string`20982099        JWKS endpoint.21002101        minLength: 121022103      - `ca_cert_pem: optional string or null`21042105        Optional custom CA (PEM) for TLS verification of the JWKS fetch.21062107        maxLength: 819221082109    - `BetaJWKSInline object`21102111      JWKS supplied directly; no network fetch.21122113      - `type: "inline"`21142115      - `keys: array of map[unknown]`21162117        Inline JWK objects.21182119        minItems: 121202121  - `jwks_polling_disabled_at: string or null`21222123    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.21242125    format: date-time21262127  - `max_jwt_lifetime_seconds: number`21282129    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.21302131  - `name: string`21322133    Admin-chosen slug identifier.21342135  - `poll_status: BetaFederationIssuerPollStatus or null`21362137    Status of automatic JWKS polling for a federation issuer.21382139    Anthropic periodically fetches the issuer's signing keys in the2140    background. These fields summarize the most recent fetches so the2141    health of the JWKS endpoint can be monitored.21422143    - `consecutive_failures: number`21442145      Consecutive fetch failures since the last success.21462147    - `last_fetched_at: string or null`21482149      When the last successful fetch completed.21502151      format: date-time21522153    - `next_poll_at: string or null`21542155      When the next fetch is scheduled. Null if paused.21562157      format: date-time21582159  - `updated_at: string`21602161    When this issuer was last updated.21622163    format: date-time21642165  - `updated_by_actor_id: string or null`21662167    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.21682169- `next_page: string or null`21702171  Opaque cursor for the next page, or null if no more results.21722173#### Example21742175```bash2176curl https://api.anthropic.com/v1/organizations/federation_issuers \2177    -H 'anthropic-version: 2023-06-01' \2178    -H "X-Api-Key: $ANTHROPIC_API_KEY"2179```21802181##### Response (200)21822183```json2184{2185  "data": [2186    {2187      "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",2188      "archived_at": "2019-12-27T18:11:19.117Z",2189      "archived_by_actor_id": "archived_by_actor_id",2190      "check_jti": true,2191      "created_at": "2024-10-30T23:58:27.427722Z",2192      "created_by_actor_id": "created_by_actor_id",2193      "issuer_url": "https://token.actions.githubusercontent.com",2194      "jwks": {2195        "type": "discovery",2196        "ca_cert_pem": "ca_cert_pem",2197        "discovery_base": "discovery_base"2198      },2199      "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",2200      "max_jwt_lifetime_seconds": 0,2201      "name": "github-actions",2202      "poll_status": {2203        "consecutive_failures": 0,2204        "last_fetched_at": "2019-12-27T18:11:19.117Z",2205        "next_poll_at": "2019-12-27T18:11:19.117Z"2206      },2207      "type": "federation_issuer",2208      "updated_at": "2024-10-30T23:58:27.427722Z",2209      "updated_by_actor_id": "updated_by_actor_id"2210    }2211  ],2212  "next_page": "next_page"2213}2214```22152216### Get Federation Issuer22172218**GET** `/v1/organizations/federation_issuers/{federation_issuer_id}`22192220**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).22212222Retrieve a federation issuer by its ID (`fdis_...`).22232224#### Path parameters22252226- `federation_issuer_id: string`22272228  ID of the federation issuer.22292230#### Headers22312232- `"anthropic-beta": optional array of AnthropicBeta`22332234  Optional header to specify the beta version(s) you want to use.22352236  - `string`22372238  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`22392240    - `"message-batches-2024-09-24"`22412242    - `"prompt-caching-2024-07-31"`22432244    - `"computer-use-2024-10-22"`22452246    - `"computer-use-2025-01-24"`22472248    - `"pdfs-2024-09-25"`22492250    - `"token-counting-2024-11-01"`22512252    - `"token-efficient-tools-2025-02-19"`22532254    - `"output-128k-2025-02-19"`22552256    - `"files-api-2025-04-14"`22572258    - `"mcp-client-2025-04-04"`22592260    - `"mcp-client-2025-11-20"`22612262    - `"dev-full-thinking-2025-05-14"`22632264    - `"interleaved-thinking-2025-05-14"`22652266    - `"code-execution-2025-05-22"`22672268    - `"extended-cache-ttl-2025-04-11"`22692270    - `"context-1m-2025-08-07"`22712272    - `"context-management-2025-06-27"`22732274    - `"model-context-window-exceeded-2025-08-26"`22752276    - `"skills-2025-10-02"`22772278    - `"fast-mode-2026-02-01"`22792280    - `"output-300k-2026-03-24"`22812282    - `"user-profiles-2026-03-24"`22832284    - `"user-profiles-2026-08-18"`22852286    - `"user-profiles-2026-09-04"`22872288    - `"advisor-tool-2026-03-01"`22892290    - `"managed-agents-2026-04-01"`22912292    - `"cache-diagnosis-2026-04-07"`22932294    - `"dreaming-2026-04-21"`22952296    - `"thinking-token-count-2026-05-13"`22972298    - `"server-side-fallback-2026-06-01"`22992300    - `"server-side-fallback-2026-07-01"`23012302    - `"fallback-credit-2026-06-01"`23032304    - `"fallback-credit-2026-07-01"`23052306    - `"agent-memory-2026-07-22"`23072308    - `"mid-conversation-tool-changes-2026-07-01"`23092310    - `"compact-2026-01-12"`23112312    - `"computer-use-2025-11-24"`23132314    - `"mcp-tunnels-2026-06-22"`23152316    - `"structured-outputs-2025-11-13"`23172318    - `"task-budgets-2026-03-13"`23192320    - `"thinking-display-updates-2026-08-18"`23212322    - `"ce-user-management-2026-07-13"`23232324    - `"mid-conversation-output-config-2026-07-01"`23252326    - `"thinking-binding-controls-2026-08-01"`23272328    - `"mid-conversation-system-clear-at-2026-08-21"`23292330    - `"compact-2026-09-04"`23312332#### Returns23332334- `BetaFederationIssuer object`23352336  Registered external OIDC identity provider.23372338  Records an external IdP the organization trusts for the RFC 75232339  jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.23402341  - `type: "federation_issuer"`23422343    default: federation_issuer23442345  - `id: string`23462347    Tagged ID of the federation issuer.23482349  - `archived_at: string or null`23502351    If set, all rules referencing this issuer reject token exchange.23522353    format: date-time23542355  - `archived_by_actor_id: string or null`23562357    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.23582359  - `check_jti: boolean`23602361    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.23622363  - `created_at: string`23642365    When this issuer was created.23662367    format: date-time23682369  - `created_by_actor_id: string or null`23702371    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.23722373  - `issuer_url: string`23742375    The `iss` claim value. Incoming JWTs must match exactly.23762377  - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`23782379    How signing keys are obtained for signature verification.23802381    - `BetaJWKSDiscovery object`23822383      JWKS via the issuer's OIDC discovery document.23842385      - `type: "discovery"`23862387      - `ca_cert_pem: optional string or null`23882389        Optional custom CA (PEM) for TLS verification of the JWKS fetch.23902391        maxLength: 819223922393      - `discovery_base: optional string or null`23942395        Set when the discovery URL differs from `issuer_url`.23962397    - `BetaJWKSExplicitURL object`23982399      JWKS fetched from a fixed endpoint.24002401      - `type: "explicit_url"`24022403      - `url: string`24042405        JWKS endpoint.24062407        minLength: 124082409      - `ca_cert_pem: optional string or null`24102411        Optional custom CA (PEM) for TLS verification of the JWKS fetch.24122413        maxLength: 819224142415    - `BetaJWKSInline object`24162417      JWKS supplied directly; no network fetch.24182419      - `type: "inline"`24202421      - `keys: array of map[unknown]`24222423        Inline JWK objects.24242425        minItems: 124262427  - `jwks_polling_disabled_at: string or null`24282429    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.24302431    format: date-time24322433  - `max_jwt_lifetime_seconds: number`24342435    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.24362437  - `name: string`24382439    Admin-chosen slug identifier.24402441  - `poll_status: BetaFederationIssuerPollStatus or null`24422443    Status of automatic JWKS polling for a federation issuer.24442445    Anthropic periodically fetches the issuer's signing keys in the2446    background. These fields summarize the most recent fetches so the2447    health of the JWKS endpoint can be monitored.24482449    - `consecutive_failures: number`24502451      Consecutive fetch failures since the last success.24522453    - `last_fetched_at: string or null`24542455      When the last successful fetch completed.24562457      format: date-time24582459    - `next_poll_at: string or null`24602461      When the next fetch is scheduled. Null if paused.24622463      format: date-time24642465  - `updated_at: string`24662467    When this issuer was last updated.24682469    format: date-time24702471  - `updated_by_actor_id: string or null`24722473    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.24742475#### Example24762477```bash2478curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \2479    -H 'anthropic-version: 2023-06-01' \2480    -H "X-Api-Key: $ANTHROPIC_API_KEY"2481```24822483##### Response (200)24842485```json2486{2487  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",2488  "archived_at": "2019-12-27T18:11:19.117Z",2489  "archived_by_actor_id": "archived_by_actor_id",2490  "check_jti": true,2491  "created_at": "2024-10-30T23:58:27.427722Z",2492  "created_by_actor_id": "created_by_actor_id",2493  "issuer_url": "https://token.actions.githubusercontent.com",2494  "jwks": {2495    "type": "discovery",2496    "ca_cert_pem": "ca_cert_pem",2497    "discovery_base": "discovery_base"2498  },2499  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",2500  "max_jwt_lifetime_seconds": 0,2501  "name": "github-actions",2502  "poll_status": {2503    "consecutive_failures": 0,2504    "last_fetched_at": "2019-12-27T18:11:19.117Z",2505    "next_poll_at": "2019-12-27T18:11:19.117Z"2506  },2507  "type": "federation_issuer",2508  "updated_at": "2024-10-30T23:58:27.427722Z",2509  "updated_by_actor_id": "updated_by_actor_id"2510}2511```25122513### Update Federation Issuer25142515**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`25162517**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).25182519Partially update a federation issuer.25202521Setting `jwks` replaces the full JWKS shape at once. Archived issuers2522cannot be updated; this returns 400. Create a new issuer instead.25232524Updating an issuer that backs a rule with a scope outside2525`workspace:developer` or `workspace:inference` requires a Console2526session.25272528#### Path parameters25292530- `federation_issuer_id: string`25312532  ID of the federation issuer to update.25332534#### Headers25352536- `"anthropic-beta": optional array of AnthropicBeta`25372538  Optional header to specify the beta version(s) you want to use.25392540  - `string`25412542  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`25432544    - `"message-batches-2024-09-24"`25452546    - `"prompt-caching-2024-07-31"`25472548    - `"computer-use-2024-10-22"`25492550    - `"computer-use-2025-01-24"`25512552    - `"pdfs-2024-09-25"`25532554    - `"token-counting-2024-11-01"`25552556    - `"token-efficient-tools-2025-02-19"`25572558    - `"output-128k-2025-02-19"`25592560    - `"files-api-2025-04-14"`25612562    - `"mcp-client-2025-04-04"`25632564    - `"mcp-client-2025-11-20"`25652566    - `"dev-full-thinking-2025-05-14"`25672568    - `"interleaved-thinking-2025-05-14"`25692570    - `"code-execution-2025-05-22"`25712572    - `"extended-cache-ttl-2025-04-11"`25732574    - `"context-1m-2025-08-07"`25752576    - `"context-management-2025-06-27"`25772578    - `"model-context-window-exceeded-2025-08-26"`25792580    - `"skills-2025-10-02"`25812582    - `"fast-mode-2026-02-01"`25832584    - `"output-300k-2026-03-24"`25852586    - `"user-profiles-2026-03-24"`25872588    - `"user-profiles-2026-08-18"`25892590    - `"user-profiles-2026-09-04"`25912592    - `"advisor-tool-2026-03-01"`25932594    - `"managed-agents-2026-04-01"`25952596    - `"cache-diagnosis-2026-04-07"`25972598    - `"dreaming-2026-04-21"`25992600    - `"thinking-token-count-2026-05-13"`26012602    - `"server-side-fallback-2026-06-01"`26032604    - `"server-side-fallback-2026-07-01"`26052606    - `"fallback-credit-2026-06-01"`26072608    - `"fallback-credit-2026-07-01"`26092610    - `"agent-memory-2026-07-22"`26112612    - `"mid-conversation-tool-changes-2026-07-01"`26132614    - `"compact-2026-01-12"`26152616    - `"computer-use-2025-11-24"`26172618    - `"mcp-tunnels-2026-06-22"`26192620    - `"structured-outputs-2025-11-13"`26212622    - `"task-budgets-2026-03-13"`26232624    - `"thinking-display-updates-2026-08-18"`26252626    - `"ce-user-management-2026-07-13"`26272628    - `"mid-conversation-output-config-2026-07-01"`26292630    - `"thinking-binding-controls-2026-08-01"`26312632    - `"mid-conversation-system-clear-at-2026-08-21"`26332634    - `"compact-2026-09-04"`26352636#### Body parameters26372638- `check_jti: optional boolean or null`26392640  Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.26412642- `issuer_url: optional string or null`26432644  Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity.26452646  minLength: 126472648- `jwks: optional BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline or null`26492650  Replaces the entire JWKS configuration.26512652  - `BetaJWKSDiscovery object`26532654    JWKS via the issuer's OIDC discovery document.26552656    - `type: "discovery"`26572658    - `ca_cert_pem: optional string or null`26592660      Optional custom CA (PEM) for TLS verification of the JWKS fetch.26612662      maxLength: 819226632664    - `discovery_base: optional string or null`26652666      Set when the discovery URL differs from `issuer_url`.26672668  - `BetaJWKSExplicitURL object`26692670    JWKS fetched from a fixed endpoint.26712672    - `type: "explicit_url"`26732674    - `url: string`26752676      JWKS endpoint.26772678      minLength: 126792680    - `ca_cert_pem: optional string or null`26812682      Optional custom CA (PEM) for TLS verification of the JWKS fetch.26832684      maxLength: 819226852686  - `BetaJWKSInline object`26872688    JWKS supplied directly; no network fetch.26892690    - `type: "inline"`26912692    - `keys: array of map[unknown]`26932694      Inline JWK objects.26952696      minItems: 126972698- `jwks_polling_disabled: optional boolean or null`26992700  Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected.27012702- `max_jwt_lifetime_seconds: optional number or null`27032704  Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.27052706  maximum: 176400, exclusiveMinimum: 027072708- `name: optional string or null`27092710  Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.27112712  maxLength: 255, minLength: 127132714#### Returns27152716- `BetaFederationIssuer object`27172718  Registered external OIDC identity provider.27192720  Records an external IdP the organization trusts for the RFC 75232721  jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.27222723  - `type: "federation_issuer"`27242725    default: federation_issuer27262727  - `id: string`27282729    Tagged ID of the federation issuer.27302731  - `archived_at: string or null`27322733    If set, all rules referencing this issuer reject token exchange.27342735    format: date-time27362737  - `archived_by_actor_id: string or null`27382739    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.27402741  - `check_jti: boolean`27422743    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.27442745  - `created_at: string`27462747    When this issuer was created.27482749    format: date-time27502751  - `created_by_actor_id: string or null`27522753    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.27542755  - `issuer_url: string`27562757    The `iss` claim value. Incoming JWTs must match exactly.27582759  - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`27602761    How signing keys are obtained for signature verification.27622763    - `BetaJWKSDiscovery object`27642765      JWKS via the issuer's OIDC discovery document.27662767      - `type: "discovery"`27682769      - `ca_cert_pem: optional string or null`27702771        Optional custom CA (PEM) for TLS verification of the JWKS fetch.27722773        maxLength: 819227742775      - `discovery_base: optional string or null`27762777        Set when the discovery URL differs from `issuer_url`.27782779    - `BetaJWKSExplicitURL object`27802781      JWKS fetched from a fixed endpoint.27822783      - `type: "explicit_url"`27842785      - `url: string`27862787        JWKS endpoint.27882789        minLength: 127902791      - `ca_cert_pem: optional string or null`27922793        Optional custom CA (PEM) for TLS verification of the JWKS fetch.27942795        maxLength: 819227962797    - `BetaJWKSInline object`27982799      JWKS supplied directly; no network fetch.28002801      - `type: "inline"`28022803      - `keys: array of map[unknown]`28042805        Inline JWK objects.28062807        minItems: 128082809  - `jwks_polling_disabled_at: string or null`28102811    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.28122813    format: date-time28142815  - `max_jwt_lifetime_seconds: number`28162817    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.28182819  - `name: string`28202821    Admin-chosen slug identifier.28222823  - `poll_status: BetaFederationIssuerPollStatus or null`28242825    Status of automatic JWKS polling for a federation issuer.28262827    Anthropic periodically fetches the issuer's signing keys in the2828    background. These fields summarize the most recent fetches so the2829    health of the JWKS endpoint can be monitored.28302831    - `consecutive_failures: number`28322833      Consecutive fetch failures since the last success.28342835    - `last_fetched_at: string or null`28362837      When the last successful fetch completed.28382839      format: date-time28402841    - `next_poll_at: string or null`28422843      When the next fetch is scheduled. Null if paused.28442845      format: date-time28462847  - `updated_at: string`28482849    When this issuer was last updated.28502851    format: date-time28522853  - `updated_by_actor_id: string or null`28542855    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.28562857#### Example28582859```bash2860curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \2861    -H 'Content-Type: application/json' \2862    -H 'anthropic-version: 2023-06-01' \2863    -H "X-Api-Key: $ANTHROPIC_API_KEY" \2864    -d '{}'2865```28662867##### Response (200)28682869```json2870{2871  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",2872  "archived_at": "2019-12-27T18:11:19.117Z",2873  "archived_by_actor_id": "archived_by_actor_id",2874  "check_jti": true,2875  "created_at": "2024-10-30T23:58:27.427722Z",2876  "created_by_actor_id": "created_by_actor_id",2877  "issuer_url": "https://token.actions.githubusercontent.com",2878  "jwks": {2879    "type": "discovery",2880    "ca_cert_pem": "ca_cert_pem",2881    "discovery_base": "discovery_base"2882  },2883  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",2884  "max_jwt_lifetime_seconds": 0,2885  "name": "github-actions",2886  "poll_status": {2887    "consecutive_failures": 0,2888    "last_fetched_at": "2019-12-27T18:11:19.117Z",2889    "next_poll_at": "2019-12-27T18:11:19.117Z"2890  },2891  "type": "federation_issuer",2892  "updated_at": "2024-10-30T23:58:27.427722Z",2893  "updated_by_actor_id": "updated_by_actor_id"2894}2895```28962897### Archive Federation Issuer28982899**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`29002901**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).29022903Archive a federation issuer.29042905Idempotent; re-archiving returns the issuer with its original2906`archived_at`. Rejected with 400 if any live (non-archived) federation2907rule still references the issuer; archive those rules first (a rule's2908issuer cannot be changed), or recreate them against another issuer.29092910#### Path parameters29112912- `federation_issuer_id: string`29132914  ID of the federation issuer to archive.29152916#### Headers29172918- `"anthropic-beta": optional array of AnthropicBeta`29192920  Optional header to specify the beta version(s) you want to use.29212922  - `string`29232924  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`29252926    - `"message-batches-2024-09-24"`29272928    - `"prompt-caching-2024-07-31"`29292930    - `"computer-use-2024-10-22"`29312932    - `"computer-use-2025-01-24"`29332934    - `"pdfs-2024-09-25"`29352936    - `"token-counting-2024-11-01"`29372938    - `"token-efficient-tools-2025-02-19"`29392940    - `"output-128k-2025-02-19"`29412942    - `"files-api-2025-04-14"`29432944    - `"mcp-client-2025-04-04"`29452946    - `"mcp-client-2025-11-20"`29472948    - `"dev-full-thinking-2025-05-14"`29492950    - `"interleaved-thinking-2025-05-14"`29512952    - `"code-execution-2025-05-22"`29532954    - `"extended-cache-ttl-2025-04-11"`29552956    - `"context-1m-2025-08-07"`29572958    - `"context-management-2025-06-27"`29592960    - `"model-context-window-exceeded-2025-08-26"`29612962    - `"skills-2025-10-02"`29632964    - `"fast-mode-2026-02-01"`29652966    - `"output-300k-2026-03-24"`29672968    - `"user-profiles-2026-03-24"`29692970    - `"user-profiles-2026-08-18"`29712972    - `"user-profiles-2026-09-04"`29732974    - `"advisor-tool-2026-03-01"`29752976    - `"managed-agents-2026-04-01"`29772978    - `"cache-diagnosis-2026-04-07"`29792980    - `"dreaming-2026-04-21"`29812982    - `"thinking-token-count-2026-05-13"`29832984    - `"server-side-fallback-2026-06-01"`29852986    - `"server-side-fallback-2026-07-01"`29872988    - `"fallback-credit-2026-06-01"`29892990    - `"fallback-credit-2026-07-01"`29912992    - `"agent-memory-2026-07-22"`29932994    - `"mid-conversation-tool-changes-2026-07-01"`29952996    - `"compact-2026-01-12"`29972998    - `"computer-use-2025-11-24"`29993000    - `"mcp-tunnels-2026-06-22"`30013002    - `"structured-outputs-2025-11-13"`30033004    - `"task-budgets-2026-03-13"`30053006    - `"thinking-display-updates-2026-08-18"`30073008    - `"ce-user-management-2026-07-13"`30093010    - `"mid-conversation-output-config-2026-07-01"`30113012    - `"thinking-binding-controls-2026-08-01"`30133014    - `"mid-conversation-system-clear-at-2026-08-21"`30153016    - `"compact-2026-09-04"`30173018#### Returns30193020- `BetaFederationIssuer object`30213022  Registered external OIDC identity provider.30233024  Records an external IdP the organization trusts for the RFC 75233025  jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.30263027  - `type: "federation_issuer"`30283029    default: federation_issuer30303031  - `id: string`30323033    Tagged ID of the federation issuer.30343035  - `archived_at: string or null`30363037    If set, all rules referencing this issuer reject token exchange.30383039    format: date-time30403041  - `archived_by_actor_id: string or null`30423043    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.30443045  - `check_jti: boolean`30463047    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.30483049  - `created_at: string`30503051    When this issuer was created.30523053    format: date-time30543055  - `created_by_actor_id: string or null`30563057    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.30583059  - `issuer_url: string`30603061    The `iss` claim value. Incoming JWTs must match exactly.30623063  - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`30643065    How signing keys are obtained for signature verification.30663067    - `BetaJWKSDiscovery object`30683069      JWKS via the issuer's OIDC discovery document.30703071      - `type: "discovery"`30723073      - `ca_cert_pem: optional string or null`30743075        Optional custom CA (PEM) for TLS verification of the JWKS fetch.30763077        maxLength: 819230783079      - `discovery_base: optional string or null`30803081        Set when the discovery URL differs from `issuer_url`.30823083    - `BetaJWKSExplicitURL object`30843085      JWKS fetched from a fixed endpoint.30863087      - `type: "explicit_url"`30883089      - `url: string`30903091        JWKS endpoint.30923093        minLength: 130943095      - `ca_cert_pem: optional string or null`30963097        Optional custom CA (PEM) for TLS verification of the JWKS fetch.30983099        maxLength: 819231003101    - `BetaJWKSInline object`31023103      JWKS supplied directly; no network fetch.31043105      - `type: "inline"`31063107      - `keys: array of map[unknown]`31083109        Inline JWK objects.31103111        minItems: 131123113  - `jwks_polling_disabled_at: string or null`31143115    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.31163117    format: date-time31183119  - `max_jwt_lifetime_seconds: number`31203121    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.31223123  - `name: string`31243125    Admin-chosen slug identifier.31263127  - `poll_status: BetaFederationIssuerPollStatus or null`31283129    Status of automatic JWKS polling for a federation issuer.31303131    Anthropic periodically fetches the issuer's signing keys in the3132    background. These fields summarize the most recent fetches so the3133    health of the JWKS endpoint can be monitored.31343135    - `consecutive_failures: number`31363137      Consecutive fetch failures since the last success.31383139    - `last_fetched_at: string or null`31403141      When the last successful fetch completed.31423143      format: date-time31443145    - `next_poll_at: string or null`31463147      When the next fetch is scheduled. Null if paused.31483149      format: date-time31503151  - `updated_at: string`31523153    When this issuer was last updated.31543155    format: date-time31563157  - `updated_by_actor_id: string or null`31583159    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.31603161#### Example31623163```bash3164curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID/archive \3165    -X POST \3166    -H 'anthropic-version: 2023-06-01' \3167    -H "X-Api-Key: $ANTHROPIC_API_KEY"3168```31693170##### Response (200)31713172```json3173{3174  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",3175  "archived_at": "2019-12-27T18:11:19.117Z",3176  "archived_by_actor_id": "archived_by_actor_id",3177  "check_jti": true,3178  "created_at": "2024-10-30T23:58:27.427722Z",3179  "created_by_actor_id": "created_by_actor_id",3180  "issuer_url": "https://token.actions.githubusercontent.com",3181  "jwks": {3182    "type": "discovery",3183    "ca_cert_pem": "ca_cert_pem",3184    "discovery_base": "discovery_base"3185  },3186  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",3187  "max_jwt_lifetime_seconds": 0,3188  "name": "github-actions",3189  "poll_status": {3190    "consecutive_failures": 0,3191    "last_fetched_at": "2019-12-27T18:11:19.117Z",3192    "next_poll_at": "2019-12-27T18:11:19.117Z"3193  },3194  "type": "federation_issuer",3195  "updated_at": "2024-10-30T23:58:27.427722Z",3196  "updated_by_actor_id": "updated_by_actor_id"3197}3198```31993200## Organization › Federation › Rules32013202### Create Federation Rule32033204**POST** `/v1/organizations/federation_rules`32053206**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).32073208Create a federation rule owned by your organization.32093210The referenced issuer and the target service account must already exist3211in the same organization; invalid references are rejected with a 4003212error. The workspace reference is validated. Membership is not checked3213at rule creation: token exchange resolves a single enabled workspace per3214call and is rejected unless the target service account is a member of3215that workspace (it is implicitly a member of the default workspace).3216Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite,3217Terraform Cloud, Google) must constrain tenant identity via an3218identity-bearing claim, a tenant-pinning subject prefix (such as3219`repo:YOUR_ORG/...`), or a CEL condition referencing one of those3220identity claims (e.g. `claims.repository_owner`). OAuth callers may only3221manage rules whose `oauth_scope` is `workspace:developer` or3222`workspace:inference`; other scopes require a Console session.32233224#### Headers32253226- `"anthropic-beta": optional array of AnthropicBeta`32273228  Optional header to specify the beta version(s) you want to use.32293230  - `string`32313232  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`32333234    - `"message-batches-2024-09-24"`32353236    - `"prompt-caching-2024-07-31"`32373238    - `"computer-use-2024-10-22"`32393240    - `"computer-use-2025-01-24"`32413242    - `"pdfs-2024-09-25"`32433244    - `"token-counting-2024-11-01"`32453246    - `"token-efficient-tools-2025-02-19"`32473248    - `"output-128k-2025-02-19"`32493250    - `"files-api-2025-04-14"`32513252    - `"mcp-client-2025-04-04"`32533254    - `"mcp-client-2025-11-20"`32553256    - `"dev-full-thinking-2025-05-14"`32573258    - `"interleaved-thinking-2025-05-14"`32593260    - `"code-execution-2025-05-22"`32613262    - `"extended-cache-ttl-2025-04-11"`32633264    - `"context-1m-2025-08-07"`32653266    - `"context-management-2025-06-27"`32673268    - `"model-context-window-exceeded-2025-08-26"`32693270    - `"skills-2025-10-02"`32713272    - `"fast-mode-2026-02-01"`32733274    - `"output-300k-2026-03-24"`32753276    - `"user-profiles-2026-03-24"`32773278    - `"user-profiles-2026-08-18"`32793280    - `"user-profiles-2026-09-04"`32813282    - `"advisor-tool-2026-03-01"`32833284    - `"managed-agents-2026-04-01"`32853286    - `"cache-diagnosis-2026-04-07"`32873288    - `"dreaming-2026-04-21"`32893290    - `"thinking-token-count-2026-05-13"`32913292    - `"server-side-fallback-2026-06-01"`32933294    - `"server-side-fallback-2026-07-01"`32953296    - `"fallback-credit-2026-06-01"`32973298    - `"fallback-credit-2026-07-01"`32993300    - `"agent-memory-2026-07-22"`33013302    - `"mid-conversation-tool-changes-2026-07-01"`33033304    - `"compact-2026-01-12"`33053306    - `"computer-use-2025-11-24"`33073308    - `"mcp-tunnels-2026-06-22"`33093310    - `"structured-outputs-2025-11-13"`33113312    - `"task-budgets-2026-03-13"`33133314    - `"thinking-display-updates-2026-08-18"`33153316    - `"ce-user-management-2026-07-13"`33173318    - `"mid-conversation-output-config-2026-07-01"`33193320    - `"thinking-binding-controls-2026-08-01"`33213322    - `"mid-conversation-system-clear-at-2026-08-21"`33233324    - `"compact-2026-09-04"`33253326#### Body parameters33273328- `issuer_id: string`33293330  Tagged ID of the federation issuer.33313332- `match: BetaFederationRuleMatch`33333334  Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.33353336  - `audience: optional string or null`33373338    Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.33393340    maxLength: 102433413342  - `claims: optional map[string] or null`33433344    Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.33453346  - `condition: optional string or null`33473348    CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.33493350    maxLength: 409633513352  - `subject_prefix: optional string or null`33533354    Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.33553356    maxLength: 102433573358- `name: string`33593360  Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.33613362  maxLength: 255, minLength: 133633364- `oauth_scope: string`33653366  Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.33673368  minLength: 133693370- `target: BetaServiceAccountTarget`33713372  Identity that tokens minted via this rule act as. Currently always a `service_account` target.33733374  - `type: "service_account"`33753376  - `service_account_id: string`33773378    Tagged ID of the service account to mint tokens for.33793380  - `service_account_name: optional string or null`33813382    Service account's display name at read time. Ignored on writes.33833384- `applies_to_all_workspaces: optional boolean`33853386  When true, enable this rule for every workspace in the org (including workspaces created later).33873388- `attributes: optional map[string] or null`33893390  CEL expressions `{name: expr}` extracting named values from claims. Not yet supported; any non-empty value is rejected with 400.33913392- `description: optional string or null`33933394  Optional free-text description.33953396  maxLength: 200033973398- `token_lifetime_seconds: optional number`33993400  Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.34013402  maximum: 86400, minimum: 6034033404- `workspace_id: optional string or null`34053406  Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.34073408#### Returns34093410- `BetaFederationRule object`34113412  Authorization rule binding an external OIDC identity to Anthropic.34133414  Evaluates the match conditions and mints an OAuth access token for the3415  resolved target, scoped to a single workspace where the rule is enabled3416  (chosen by the caller at exchange time when the rule is enabled for more3417  than one). For rules enabled via `workspace_ids` or3418  `applies_to_all_workspaces`, the target service account must be a member3419  of that workspace (it is implicitly a member of the default workspace);3420  rules carrying only the legacy `workspace_id` binding do not enforce3421  this.34223423  - `type: "federation_rule"`34243425    default: federation_rule34263427  - `id: string`34283429    Tagged ID of the federation rule.34303431  - `applies_to_all_workspaces: boolean`34323433    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.34343435  - `archived_at: string or null`34363437    If set, this rule is archived and rejects token exchange.34383439    format: date-time34403441  - `archived_by_actor_id: string or null`34423443    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.34443445  - `attributes: map[string] or null`34463447    CEL expressions extracting named values from claims. Not yet supported; always null.34483449  - `created_at: string`34503451    When this rule was created.34523453    format: date-time34543455  - `created_by_actor_id: string or null`34563457    Tagged ID (`user_`/`svac_`) of the actor that created this rule.34583459  - `description: string or null`34603461    Optional free-text description.34623463  - `issuer_id: string`34643465    Tagged ID of the issuer whose tokens this rule accepts.34663467  - `issuer_name: string or null`34683469    Issuer's display name at read time.34703471  - `match: BetaFederationRuleMatch`34723473    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.34743475    - `audience: optional string or null`34763477      Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.34783479      maxLength: 102434803481    - `claims: optional map[string] or null`34823483      Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.34843485    - `condition: optional string or null`34863487      CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.34883489      maxLength: 409634903491    - `subject_prefix: optional string or null`34923493      Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.34943495      maxLength: 102434963497  - `name: string`34983499    Admin-chosen slug identifier.35003501  - `oauth_scope: string`35023503    Space-separated OAuth scopes granted on the minted token.35043505  - `target: BetaServiceAccountTarget`35063507    Identity that tokens minted via this rule act as. Currently always a `service_account` target.35083509    - `type: "service_account"`35103511    - `service_account_id: string`35123513      Tagged ID of the service account to mint tokens for.35143515    - `service_account_name: optional string or null`35163517      Service account's display name at read time. Ignored on writes.35183519  - `token_lifetime_seconds: number`35203521    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.35223523  - `updated_at: string`35243525    When this rule was last updated.35263527    format: date-time35283529  - `updated_by_actor_id: string or null`35303531    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.35323533  - `workspace_id: string or null`35343535    Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.35363537  - `workspace_ids: array of string`35383539    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).35403541#### Example35423543```bash3544curl https://api.anthropic.com/v1/organizations/federation_rules \3545    -H 'Content-Type: application/json' \3546    -H 'anthropic-version: 2023-06-01' \3547    -H "X-Api-Key: $ANTHROPIC_API_KEY" \3548    -d '{3549          "issuer_id": "issuer_id",3550          "match": {},3551          "name": "x",3552          "oauth_scope": "x",3553          "target": {3554            "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",3555            "type": "service_account"3556          }3557        }'3558```35593560##### Response (200)35613562```json3563{3564  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",3565  "applies_to_all_workspaces": true,3566  "archived_at": "2019-12-27T18:11:19.117Z",3567  "archived_by_actor_id": "archived_by_actor_id",3568  "attributes": {3569    "foo": "string"3570  },3571  "created_at": "2024-10-30T23:58:27.427722Z",3572  "created_by_actor_id": "created_by_actor_id",3573  "description": "description",3574  "issuer_id": "issuer_id",3575  "issuer_name": "issuer_name",3576  "match": {3577    "audience": "audience",3578    "claims": {3579      "foo": "string"3580    },3581    "condition": "condition",3582    "subject_prefix": "subject_prefix"3583  },3584  "name": "prod-deploy-pipeline",3585  "oauth_scope": "oauth_scope",3586  "target": {3587    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",3588    "type": "service_account",3589    "service_account_name": "service_account_name"3590  },3591  "token_lifetime_seconds": 0,3592  "type": "federation_rule",3593  "updated_at": "2024-10-30T23:58:27.427722Z",3594  "updated_by_actor_id": "updated_by_actor_id",3595  "workspace_id": "workspace_id",3596  "workspace_ids": [3597    "string"3598  ]3599}3600```36013602### List Federation Rules36033604**GET** `/v1/organizations/federation_rules`36053606**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).36073608List federation rules in your organization.36093610Optionally filter by issuer with `issuer_id`. Archived rules are excluded3611unless `include_archived=true`.36123613#### Query parameters36143615- `include_archived: optional boolean`36163617  Include archived resources. Defaults to false.36183619  default: false36203621- `issuer_id: optional string`36223623  Filter to rules referencing this federation issuer.36243625- `limit: optional number`36263627  Number of results per page.36283629  default: 20, maximum: 100, minimum: 136303631- `page: optional string`36323633  Opaque cursor from a previous response's `next_page`.36343635#### Headers36363637- `"anthropic-beta": optional array of AnthropicBeta`36383639  Optional header to specify the beta version(s) you want to use.36403641  - `string`36423643  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`36443645    - `"message-batches-2024-09-24"`36463647    - `"prompt-caching-2024-07-31"`36483649    - `"computer-use-2024-10-22"`36503651    - `"computer-use-2025-01-24"`36523653    - `"pdfs-2024-09-25"`36543655    - `"token-counting-2024-11-01"`36563657    - `"token-efficient-tools-2025-02-19"`36583659    - `"output-128k-2025-02-19"`36603661    - `"files-api-2025-04-14"`36623663    - `"mcp-client-2025-04-04"`36643665    - `"mcp-client-2025-11-20"`36663667    - `"dev-full-thinking-2025-05-14"`36683669    - `"interleaved-thinking-2025-05-14"`36703671    - `"code-execution-2025-05-22"`36723673    - `"extended-cache-ttl-2025-04-11"`36743675    - `"context-1m-2025-08-07"`36763677    - `"context-management-2025-06-27"`36783679    - `"model-context-window-exceeded-2025-08-26"`36803681    - `"skills-2025-10-02"`36823683    - `"fast-mode-2026-02-01"`36843685    - `"output-300k-2026-03-24"`36863687    - `"user-profiles-2026-03-24"`36883689    - `"user-profiles-2026-08-18"`36903691    - `"user-profiles-2026-09-04"`36923693    - `"advisor-tool-2026-03-01"`36943695    - `"managed-agents-2026-04-01"`36963697    - `"cache-diagnosis-2026-04-07"`36983699    - `"dreaming-2026-04-21"`37003701    - `"thinking-token-count-2026-05-13"`37023703    - `"server-side-fallback-2026-06-01"`37043705    - `"server-side-fallback-2026-07-01"`37063707    - `"fallback-credit-2026-06-01"`37083709    - `"fallback-credit-2026-07-01"`37103711    - `"agent-memory-2026-07-22"`37123713    - `"mid-conversation-tool-changes-2026-07-01"`37143715    - `"compact-2026-01-12"`37163717    - `"computer-use-2025-11-24"`37183719    - `"mcp-tunnels-2026-06-22"`37203721    - `"structured-outputs-2025-11-13"`37223723    - `"task-budgets-2026-03-13"`37243725    - `"thinking-display-updates-2026-08-18"`37263727    - `"ce-user-management-2026-07-13"`37283729    - `"mid-conversation-output-config-2026-07-01"`37303731    - `"thinking-binding-controls-2026-08-01"`37323733    - `"mid-conversation-system-clear-at-2026-08-21"`37343735    - `"compact-2026-09-04"`37363737#### Returns37383739- `data: array of BetaFederationRule`37403741  - `type: "federation_rule"`37423743    default: federation_rule37443745  - `id: string`37463747    Tagged ID of the federation rule.37483749  - `applies_to_all_workspaces: boolean`37503751    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.37523753  - `archived_at: string or null`37543755    If set, this rule is archived and rejects token exchange.37563757    format: date-time37583759  - `archived_by_actor_id: string or null`37603761    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.37623763  - `attributes: map[string] or null`37643765    CEL expressions extracting named values from claims. Not yet supported; always null.37663767  - `created_at: string`37683769    When this rule was created.37703771    format: date-time37723773  - `created_by_actor_id: string or null`37743775    Tagged ID (`user_`/`svac_`) of the actor that created this rule.37763777  - `description: string or null`37783779    Optional free-text description.37803781  - `issuer_id: string`37823783    Tagged ID of the issuer whose tokens this rule accepts.37843785  - `issuer_name: string or null`37863787    Issuer's display name at read time.37883789  - `match: BetaFederationRuleMatch`37903791    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.37923793    - `audience: optional string or null`37943795      Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.37963797      maxLength: 102437983799    - `claims: optional map[string] or null`38003801      Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.38023803    - `condition: optional string or null`38043805      CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.38063807      maxLength: 409638083809    - `subject_prefix: optional string or null`38103811      Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.38123813      maxLength: 102438143815  - `name: string`38163817    Admin-chosen slug identifier.38183819  - `oauth_scope: string`38203821    Space-separated OAuth scopes granted on the minted token.38223823  - `target: BetaServiceAccountTarget`38243825    Identity that tokens minted via this rule act as. Currently always a `service_account` target.38263827    - `type: "service_account"`38283829    - `service_account_id: string`38303831      Tagged ID of the service account to mint tokens for.38323833    - `service_account_name: optional string or null`38343835      Service account's display name at read time. Ignored on writes.38363837  - `token_lifetime_seconds: number`38383839    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.38403841  - `updated_at: string`38423843    When this rule was last updated.38443845    format: date-time38463847  - `updated_by_actor_id: string or null`38483849    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.38503851  - `workspace_id: string or null`38523853    Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.38543855  - `workspace_ids: array of string`38563857    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).38583859- `next_page: string or null`38603861  Opaque cursor for the next page, or null if no more results.38623863#### Example38643865```bash3866curl https://api.anthropic.com/v1/organizations/federation_rules \3867    -H 'anthropic-version: 2023-06-01' \3868    -H "X-Api-Key: $ANTHROPIC_API_KEY"3869```38703871##### Response (200)38723873```json3874{3875  "data": [3876    {3877      "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",3878      "applies_to_all_workspaces": true,3879      "archived_at": "2019-12-27T18:11:19.117Z",3880      "archived_by_actor_id": "archived_by_actor_id",3881      "attributes": {3882        "foo": "string"3883      },3884      "created_at": "2024-10-30T23:58:27.427722Z",3885      "created_by_actor_id": "created_by_actor_id",3886      "description": "description",3887      "issuer_id": "issuer_id",3888      "issuer_name": "issuer_name",3889      "match": {3890        "audience": "audience",3891        "claims": {3892          "foo": "string"3893        },3894        "condition": "condition",3895        "subject_prefix": "subject_prefix"3896      },3897      "name": "prod-deploy-pipeline",3898      "oauth_scope": "oauth_scope",3899      "target": {3900        "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",3901        "type": "service_account",3902        "service_account_name": "service_account_name"3903      },3904      "token_lifetime_seconds": 0,3905      "type": "federation_rule",3906      "updated_at": "2024-10-30T23:58:27.427722Z",3907      "updated_by_actor_id": "updated_by_actor_id",3908      "workspace_id": "workspace_id",3909      "workspace_ids": [3910        "string"3911      ]3912    }3913  ],3914  "next_page": "next_page"3915}3916```39173918### Get Federation Rule39193920**GET** `/v1/organizations/federation_rules/{federation_rule_id}`39213922**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).39233924Retrieve a federation rule by its ID (`fdrl_...`).39253926#### Path parameters39273928- `federation_rule_id: string`39293930  ID of the federation rule.39313932#### Headers39333934- `"anthropic-beta": optional array of AnthropicBeta`39353936  Optional header to specify the beta version(s) you want to use.39373938  - `string`39393940  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`39413942    - `"message-batches-2024-09-24"`39433944    - `"prompt-caching-2024-07-31"`39453946    - `"computer-use-2024-10-22"`39473948    - `"computer-use-2025-01-24"`39493950    - `"pdfs-2024-09-25"`39513952    - `"token-counting-2024-11-01"`39533954    - `"token-efficient-tools-2025-02-19"`39553956    - `"output-128k-2025-02-19"`39573958    - `"files-api-2025-04-14"`39593960    - `"mcp-client-2025-04-04"`39613962    - `"mcp-client-2025-11-20"`39633964    - `"dev-full-thinking-2025-05-14"`39653966    - `"interleaved-thinking-2025-05-14"`39673968    - `"code-execution-2025-05-22"`39693970    - `"extended-cache-ttl-2025-04-11"`39713972    - `"context-1m-2025-08-07"`39733974    - `"context-management-2025-06-27"`39753976    - `"model-context-window-exceeded-2025-08-26"`39773978    - `"skills-2025-10-02"`39793980    - `"fast-mode-2026-02-01"`39813982    - `"output-300k-2026-03-24"`39833984    - `"user-profiles-2026-03-24"`39853986    - `"user-profiles-2026-08-18"`39873988    - `"user-profiles-2026-09-04"`39893990    - `"advisor-tool-2026-03-01"`39913992    - `"managed-agents-2026-04-01"`39933994    - `"cache-diagnosis-2026-04-07"`39953996    - `"dreaming-2026-04-21"`39973998    - `"thinking-token-count-2026-05-13"`39994000    - `"server-side-fallback-2026-06-01"`40014002    - `"server-side-fallback-2026-07-01"`40034004    - `"fallback-credit-2026-06-01"`40054006    - `"fallback-credit-2026-07-01"`40074008    - `"agent-memory-2026-07-22"`40094010    - `"mid-conversation-tool-changes-2026-07-01"`40114012    - `"compact-2026-01-12"`40134014    - `"computer-use-2025-11-24"`40154016    - `"mcp-tunnels-2026-06-22"`40174018    - `"structured-outputs-2025-11-13"`40194020    - `"task-budgets-2026-03-13"`40214022    - `"thinking-display-updates-2026-08-18"`40234024    - `"ce-user-management-2026-07-13"`40254026    - `"mid-conversation-output-config-2026-07-01"`40274028    - `"thinking-binding-controls-2026-08-01"`40294030    - `"mid-conversation-system-clear-at-2026-08-21"`40314032    - `"compact-2026-09-04"`40334034#### Returns40354036- `BetaFederationRule object`40374038  Authorization rule binding an external OIDC identity to Anthropic.40394040  Evaluates the match conditions and mints an OAuth access token for the4041  resolved target, scoped to a single workspace where the rule is enabled4042  (chosen by the caller at exchange time when the rule is enabled for more4043  than one). For rules enabled via `workspace_ids` or4044  `applies_to_all_workspaces`, the target service account must be a member4045  of that workspace (it is implicitly a member of the default workspace);4046  rules carrying only the legacy `workspace_id` binding do not enforce4047  this.40484049  - `type: "federation_rule"`40504051    default: federation_rule40524053  - `id: string`40544055    Tagged ID of the federation rule.40564057  - `applies_to_all_workspaces: boolean`40584059    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.40604061  - `archived_at: string or null`40624063    If set, this rule is archived and rejects token exchange.40644065    format: date-time40664067  - `archived_by_actor_id: string or null`40684069    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.40704071  - `attributes: map[string] or null`40724073    CEL expressions extracting named values from claims. Not yet supported; always null.40744075  - `created_at: string`40764077    When this rule was created.40784079    format: date-time40804081  - `created_by_actor_id: string or null`40824083    Tagged ID (`user_`/`svac_`) of the actor that created this rule.40844085  - `description: string or null`40864087    Optional free-text description.40884089  - `issuer_id: string`40904091    Tagged ID of the issuer whose tokens this rule accepts.40924093  - `issuer_name: string or null`40944095    Issuer's display name at read time.40964097  - `match: BetaFederationRuleMatch`40984099    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.41004101    - `audience: optional string or null`41024103      Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.41044105      maxLength: 102441064107    - `claims: optional map[string] or null`41084109      Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.41104111    - `condition: optional string or null`41124113      CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.41144115      maxLength: 409641164117    - `subject_prefix: optional string or null`41184119      Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.41204121      maxLength: 102441224123  - `name: string`41244125    Admin-chosen slug identifier.41264127  - `oauth_scope: string`41284129    Space-separated OAuth scopes granted on the minted token.41304131  - `target: BetaServiceAccountTarget`41324133    Identity that tokens minted via this rule act as. Currently always a `service_account` target.41344135    - `type: "service_account"`41364137    - `service_account_id: string`41384139      Tagged ID of the service account to mint tokens for.41404141    - `service_account_name: optional string or null`41424143      Service account's display name at read time. Ignored on writes.41444145  - `token_lifetime_seconds: number`41464147    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.41484149  - `updated_at: string`41504151    When this rule was last updated.41524153    format: date-time41544155  - `updated_by_actor_id: string or null`41564157    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.41584159  - `workspace_id: string or null`41604161    Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.41624163  - `workspace_ids: array of string`41644165    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).41664167#### Example41684169```bash4170curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \4171    -H 'anthropic-version: 2023-06-01' \4172    -H "X-Api-Key: $ANTHROPIC_API_KEY"4173```41744175##### Response (200)41764177```json4178{4179  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",4180  "applies_to_all_workspaces": true,4181  "archived_at": "2019-12-27T18:11:19.117Z",4182  "archived_by_actor_id": "archived_by_actor_id",4183  "attributes": {4184    "foo": "string"4185  },4186  "created_at": "2024-10-30T23:58:27.427722Z",4187  "created_by_actor_id": "created_by_actor_id",4188  "description": "description",4189  "issuer_id": "issuer_id",4190  "issuer_name": "issuer_name",4191  "match": {4192    "audience": "audience",4193    "claims": {4194      "foo": "string"4195    },4196    "condition": "condition",4197    "subject_prefix": "subject_prefix"4198  },4199  "name": "prod-deploy-pipeline",4200  "oauth_scope": "oauth_scope",4201  "target": {4202    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",4203    "type": "service_account",4204    "service_account_name": "service_account_name"4205  },4206  "token_lifetime_seconds": 0,4207  "type": "federation_rule",4208  "updated_at": "2024-10-30T23:58:27.427722Z",4209  "updated_by_actor_id": "updated_by_actor_id",4210  "workspace_id": "workspace_id",4211  "workspace_ids": [4212    "string"4213  ]4214}4215```42164217### Update Federation Rule42184219**POST** `/v1/organizations/federation_rules/{federation_rule_id}`42204221**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).42224223Partially update a federation rule.42244225`issuer_id` is immutable. `match` and `target` are replaced as whole4226objects when set. Referenced service accounts and workspaces must exist4227in your organization; invalid references are rejected with a 400 error.4228Archived rules cannot be updated; this returns 400. Create a new rule4229instead. Rules on well-known shared issuers (GitHub Actions, GitLab,4230Buildkite, Terraform Cloud, Google) must constrain tenant identity via4231an identity-bearing claim, a tenant-pinning subject prefix (such as4232`repo:YOUR_ORG/...`), or a CEL condition referencing one of those4233identity claims (e.g. `claims.repository_owner`). On these issuers the4234requirement is re-checked on every update; if an existing rule's stored4235match does not yet constrain tenant identity, any update (even a rename4236or description change) must also supply a conforming `match` in the same4237request. OAuth callers may only manage rules whose `oauth_scope` is4238`workspace:developer` or `workspace:inference`; other scopes require a4239Console session.42404241#### Path parameters42424243- `federation_rule_id: string`42444245  ID of the federation rule to update.42464247#### Headers42484249- `"anthropic-beta": optional array of AnthropicBeta`42504251  Optional header to specify the beta version(s) you want to use.42524253  - `string`42544255  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`42564257    - `"message-batches-2024-09-24"`42584259    - `"prompt-caching-2024-07-31"`42604261    - `"computer-use-2024-10-22"`42624263    - `"computer-use-2025-01-24"`42644265    - `"pdfs-2024-09-25"`42664267    - `"token-counting-2024-11-01"`42684269    - `"token-efficient-tools-2025-02-19"`42704271    - `"output-128k-2025-02-19"`42724273    - `"files-api-2025-04-14"`42744275    - `"mcp-client-2025-04-04"`42764277    - `"mcp-client-2025-11-20"`42784279    - `"dev-full-thinking-2025-05-14"`42804281    - `"interleaved-thinking-2025-05-14"`42824283    - `"code-execution-2025-05-22"`42844285    - `"extended-cache-ttl-2025-04-11"`42864287    - `"context-1m-2025-08-07"`42884289    - `"context-management-2025-06-27"`42904291    - `"model-context-window-exceeded-2025-08-26"`42924293    - `"skills-2025-10-02"`42944295    - `"fast-mode-2026-02-01"`42964297    - `"output-300k-2026-03-24"`42984299    - `"user-profiles-2026-03-24"`43004301    - `"user-profiles-2026-08-18"`43024303    - `"user-profiles-2026-09-04"`43044305    - `"advisor-tool-2026-03-01"`43064307    - `"managed-agents-2026-04-01"`43084309    - `"cache-diagnosis-2026-04-07"`43104311    - `"dreaming-2026-04-21"`43124313    - `"thinking-token-count-2026-05-13"`43144315    - `"server-side-fallback-2026-06-01"`43164317    - `"server-side-fallback-2026-07-01"`43184319    - `"fallback-credit-2026-06-01"`43204321    - `"fallback-credit-2026-07-01"`43224323    - `"agent-memory-2026-07-22"`43244325    - `"mid-conversation-tool-changes-2026-07-01"`43264327    - `"compact-2026-01-12"`43284329    - `"computer-use-2025-11-24"`43304331    - `"mcp-tunnels-2026-06-22"`43324333    - `"structured-outputs-2025-11-13"`43344335    - `"task-budgets-2026-03-13"`43364337    - `"thinking-display-updates-2026-08-18"`43384339    - `"ce-user-management-2026-07-13"`43404341    - `"mid-conversation-output-config-2026-07-01"`43424343    - `"thinking-binding-controls-2026-08-01"`43444345    - `"mid-conversation-system-clear-at-2026-08-21"`43464347    - `"compact-2026-09-04"`43484349#### Body parameters43504351- `applies_to_all_workspaces: optional boolean or null`43524353  When true, enables this rule for every workspace in the org (including workspaces created later). Setting `false` is rejected with 400 if no workspace would remain enabled; a rule with only a legacy `workspace_id` binding continues to mint.43544355- `attributes: optional map[string] or null`43564357  Replaces the CEL expressions `{name: expr}` extracting named values from claims. Send null to clear them. Not yet supported; any non-empty value is rejected with 400.43584359- `description: optional string or null`43604361  Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).43624363  maxLength: 200043644365- `match: optional BetaFederationRuleMatch or null`43664367  Does the incoming JWT qualify?43684369  All populated fields must pass; omitted fields are skipped. At least one4370  of `subject_prefix` (other than a wildcard-only value like `*`), `claims`,4371  or `condition` is required; `audience` alone is not sufficient.43724373  - `audience: optional string or null`43744375    Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.43764377    maxLength: 102443784379  - `claims: optional map[string] or null`43804381    Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.43824383  - `condition: optional string or null`43844385    CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.43864387    maxLength: 409643884389  - `subject_prefix: optional string or null`43904391    Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.43924393    maxLength: 102443944395- `name: optional string or null`43964397  Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.43984399  maxLength: 255, minLength: 144004401- `oauth_scope: optional string or null`44024403  Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.44044405  minLength: 144064407- `target: optional BetaServiceAccountTarget or null`44084409  Bind to a fixed service account by ID.44104411  - `type: "service_account"`44124413  - `service_account_id: string`44144415    Tagged ID of the service account to mint tokens for.44164417  - `service_account_name: optional string or null`44184419    Service account's display name at read time. Ignored on writes.44204421- `token_lifetime_seconds: optional number or null`44224423  Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.44244425  maximum: 86400, minimum: 6044264427- `workspace_id: optional string or null`44284429  Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead.44304431#### Returns44324433- `BetaFederationRule object`44344435  Authorization rule binding an external OIDC identity to Anthropic.44364437  Evaluates the match conditions and mints an OAuth access token for the4438  resolved target, scoped to a single workspace where the rule is enabled4439  (chosen by the caller at exchange time when the rule is enabled for more4440  than one). For rules enabled via `workspace_ids` or4441  `applies_to_all_workspaces`, the target service account must be a member4442  of that workspace (it is implicitly a member of the default workspace);4443  rules carrying only the legacy `workspace_id` binding do not enforce4444  this.44454446  - `type: "federation_rule"`44474448    default: federation_rule44494450  - `id: string`44514452    Tagged ID of the federation rule.44534454  - `applies_to_all_workspaces: boolean`44554456    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.44574458  - `archived_at: string or null`44594460    If set, this rule is archived and rejects token exchange.44614462    format: date-time44634464  - `archived_by_actor_id: string or null`44654466    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.44674468  - `attributes: map[string] or null`44694470    CEL expressions extracting named values from claims. Not yet supported; always null.44714472  - `created_at: string`44734474    When this rule was created.44754476    format: date-time44774478  - `created_by_actor_id: string or null`44794480    Tagged ID (`user_`/`svac_`) of the actor that created this rule.44814482  - `description: string or null`44834484    Optional free-text description.44854486  - `issuer_id: string`44874488    Tagged ID of the issuer whose tokens this rule accepts.44894490  - `issuer_name: string or null`44914492    Issuer's display name at read time.44934494  - `match: BetaFederationRuleMatch`44954496    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.44974498    - `audience: optional string or null`44994500      Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.45014502      maxLength: 102445034504    - `claims: optional map[string] or null`45054506      Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.45074508    - `condition: optional string or null`45094510      CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.45114512      maxLength: 409645134514    - `subject_prefix: optional string or null`45154516      Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.45174518      maxLength: 102445194520  - `name: string`45214522    Admin-chosen slug identifier.45234524  - `oauth_scope: string`45254526    Space-separated OAuth scopes granted on the minted token.45274528  - `target: BetaServiceAccountTarget`45294530    Identity that tokens minted via this rule act as. Currently always a `service_account` target.45314532    - `type: "service_account"`45334534    - `service_account_id: string`45354536      Tagged ID of the service account to mint tokens for.45374538    - `service_account_name: optional string or null`45394540      Service account's display name at read time. Ignored on writes.45414542  - `token_lifetime_seconds: number`45434544    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.45454546  - `updated_at: string`45474548    When this rule was last updated.45494550    format: date-time45514552  - `updated_by_actor_id: string or null`45534554    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.45554556  - `workspace_id: string or null`45574558    Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.45594560  - `workspace_ids: array of string`45614562    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).45634564#### Example45654566```bash4567curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \4568    -H 'Content-Type: application/json' \4569    -H 'anthropic-version: 2023-06-01' \4570    -H "X-Api-Key: $ANTHROPIC_API_KEY" \4571    -d '{}'4572```45734574##### Response (200)45754576```json4577{4578  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",4579  "applies_to_all_workspaces": true,4580  "archived_at": "2019-12-27T18:11:19.117Z",4581  "archived_by_actor_id": "archived_by_actor_id",4582  "attributes": {4583    "foo": "string"4584  },4585  "created_at": "2024-10-30T23:58:27.427722Z",4586  "created_by_actor_id": "created_by_actor_id",4587  "description": "description",4588  "issuer_id": "issuer_id",4589  "issuer_name": "issuer_name",4590  "match": {4591    "audience": "audience",4592    "claims": {4593      "foo": "string"4594    },4595    "condition": "condition",4596    "subject_prefix": "subject_prefix"4597  },4598  "name": "prod-deploy-pipeline",4599  "oauth_scope": "oauth_scope",4600  "target": {4601    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",4602    "type": "service_account",4603    "service_account_name": "service_account_name"4604  },4605  "token_lifetime_seconds": 0,4606  "type": "federation_rule",4607  "updated_at": "2024-10-30T23:58:27.427722Z",4608  "updated_by_actor_id": "updated_by_actor_id",4609  "workspace_id": "workspace_id",4610  "workspace_ids": [4611    "string"4612  ]4613}4614```46154616### Archive Federation Rule46174618**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`46194620**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).46214622Archive a federation rule.46234624Token exchange through this rule stops immediately. Idempotent;4625re-archiving returns the rule with its original `archived_at`. Archiving4626clears the rule's workspace targeting (`workspace_id` and4627`workspace_ids` are emptied). Tokens already minted before archive4628remain valid until they expire. OAuth callers may only manage rules4629whose `oauth_scope` is `workspace:developer` or `workspace:inference`;4630other scopes require a Console session.46314632#### Path parameters46334634- `federation_rule_id: string`46354636  ID of the federation rule to archive.46374638#### Headers46394640- `"anthropic-beta": optional array of AnthropicBeta`46414642  Optional header to specify the beta version(s) you want to use.46434644  - `string`46454646  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`46474648    - `"message-batches-2024-09-24"`46494650    - `"prompt-caching-2024-07-31"`46514652    - `"computer-use-2024-10-22"`46534654    - `"computer-use-2025-01-24"`46554656    - `"pdfs-2024-09-25"`46574658    - `"token-counting-2024-11-01"`46594660    - `"token-efficient-tools-2025-02-19"`46614662    - `"output-128k-2025-02-19"`46634664    - `"files-api-2025-04-14"`46654666    - `"mcp-client-2025-04-04"`46674668    - `"mcp-client-2025-11-20"`46694670    - `"dev-full-thinking-2025-05-14"`46714672    - `"interleaved-thinking-2025-05-14"`46734674    - `"code-execution-2025-05-22"`46754676    - `"extended-cache-ttl-2025-04-11"`46774678    - `"context-1m-2025-08-07"`46794680    - `"context-management-2025-06-27"`46814682    - `"model-context-window-exceeded-2025-08-26"`46834684    - `"skills-2025-10-02"`46854686    - `"fast-mode-2026-02-01"`46874688    - `"output-300k-2026-03-24"`46894690    - `"user-profiles-2026-03-24"`46914692    - `"user-profiles-2026-08-18"`46934694    - `"user-profiles-2026-09-04"`46954696    - `"advisor-tool-2026-03-01"`46974698    - `"managed-agents-2026-04-01"`46994700    - `"cache-diagnosis-2026-04-07"`47014702    - `"dreaming-2026-04-21"`47034704    - `"thinking-token-count-2026-05-13"`47054706    - `"server-side-fallback-2026-06-01"`47074708    - `"server-side-fallback-2026-07-01"`47094710    - `"fallback-credit-2026-06-01"`47114712    - `"fallback-credit-2026-07-01"`47134714    - `"agent-memory-2026-07-22"`47154716    - `"mid-conversation-tool-changes-2026-07-01"`47174718    - `"compact-2026-01-12"`47194720    - `"computer-use-2025-11-24"`47214722    - `"mcp-tunnels-2026-06-22"`47234724    - `"structured-outputs-2025-11-13"`47254726    - `"task-budgets-2026-03-13"`47274728    - `"thinking-display-updates-2026-08-18"`47294730    - `"ce-user-management-2026-07-13"`47314732    - `"mid-conversation-output-config-2026-07-01"`47334734    - `"thinking-binding-controls-2026-08-01"`47354736    - `"mid-conversation-system-clear-at-2026-08-21"`47374738    - `"compact-2026-09-04"`47394740#### Returns47414742- `BetaFederationRule object`47434744  Authorization rule binding an external OIDC identity to Anthropic.47454746  Evaluates the match conditions and mints an OAuth access token for the4747  resolved target, scoped to a single workspace where the rule is enabled4748  (chosen by the caller at exchange time when the rule is enabled for more4749  than one). For rules enabled via `workspace_ids` or4750  `applies_to_all_workspaces`, the target service account must be a member4751  of that workspace (it is implicitly a member of the default workspace);4752  rules carrying only the legacy `workspace_id` binding do not enforce4753  this.47544755  - `type: "federation_rule"`47564757    default: federation_rule47584759  - `id: string`47604761    Tagged ID of the federation rule.47624763  - `applies_to_all_workspaces: boolean`47644765    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.47664767  - `archived_at: string or null`47684769    If set, this rule is archived and rejects token exchange.47704771    format: date-time47724773  - `archived_by_actor_id: string or null`47744775    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.47764777  - `attributes: map[string] or null`47784779    CEL expressions extracting named values from claims. Not yet supported; always null.47804781  - `created_at: string`47824783    When this rule was created.47844785    format: date-time47864787  - `created_by_actor_id: string or null`47884789    Tagged ID (`user_`/`svac_`) of the actor that created this rule.47904791  - `description: string or null`47924793    Optional free-text description.47944795  - `issuer_id: string`47964797    Tagged ID of the issuer whose tokens this rule accepts.47984799  - `issuer_name: string or null`48004801    Issuer's display name at read time.48024803  - `match: BetaFederationRuleMatch`48044805    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.48064807    - `audience: optional string or null`48084809      Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.48104811      maxLength: 102448124813    - `claims: optional map[string] or null`48144815      Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.48164817    - `condition: optional string or null`48184819      CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.48204821      maxLength: 409648224823    - `subject_prefix: optional string or null`48244825      Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.48264827      maxLength: 102448284829  - `name: string`48304831    Admin-chosen slug identifier.48324833  - `oauth_scope: string`48344835    Space-separated OAuth scopes granted on the minted token.48364837  - `target: BetaServiceAccountTarget`48384839    Identity that tokens minted via this rule act as. Currently always a `service_account` target.48404841    - `type: "service_account"`48424843    - `service_account_id: string`48444845      Tagged ID of the service account to mint tokens for.48464847    - `service_account_name: optional string or null`48484849      Service account's display name at read time. Ignored on writes.48504851  - `token_lifetime_seconds: number`48524853    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.48544855  - `updated_at: string`48564857    When this rule was last updated.48584859    format: date-time48604861  - `updated_by_actor_id: string or null`48624863    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.48644865  - `workspace_id: string or null`48664867    Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.48684869  - `workspace_ids: array of string`48704871    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).48724873#### Example48744875```bash4876curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \4877    -X POST \4878    -H 'anthropic-version: 2023-06-01' \4879    -H "X-Api-Key: $ANTHROPIC_API_KEY"4880```48814882##### Response (200)48834884```json4885{4886  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",4887  "applies_to_all_workspaces": true,4888  "archived_at": "2019-12-27T18:11:19.117Z",4889  "archived_by_actor_id": "archived_by_actor_id",4890  "attributes": {4891    "foo": "string"4892  },4893  "created_at": "2024-10-30T23:58:27.427722Z",4894  "created_by_actor_id": "created_by_actor_id",4895  "description": "description",4896  "issuer_id": "issuer_id",4897  "issuer_name": "issuer_name",4898  "match": {4899    "audience": "audience",4900    "claims": {4901      "foo": "string"4902    },4903    "condition": "condition",4904    "subject_prefix": "subject_prefix"4905  },4906  "name": "prod-deploy-pipeline",4907  "oauth_scope": "oauth_scope",4908  "target": {4909    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",4910    "type": "service_account",4911    "service_account_name": "service_account_name"4912  },4913  "token_lifetime_seconds": 0,4914  "type": "federation_rule",4915  "updated_at": "2024-10-30T23:58:27.427722Z",4916  "updated_by_actor_id": "updated_by_actor_id",4917  "workspace_id": "workspace_id",4918  "workspace_ids": [4919    "string"4920  ]4921}4922```49234924## Organization › Federation › Rules › Workspaces49254926### Add Federation Rule Workspace49274928**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`49294930**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).49314932Enable a federation rule for a workspace.49334934Idempotent; re-enabling returns the existing enablement. The rule and4935workspace must both belong to your organization. Membership of the4936rule's target service account in this workspace is not checked at4937enablement: token exchange into this workspace is rejected unless the4938target is a member (it is implicitly a member of the default workspace).4939Archived rules are rejected with 400. OAuth callers may only manage rules4940whose `oauth_scope` is `workspace:developer` or `workspace:inference`;4941other scopes require a Console session.49424943#### Path parameters49444945- `federation_rule_id: string`49464947  ID of the federation rule.49484949#### Headers49504951- `"anthropic-beta": optional array of AnthropicBeta`49524953  Optional header to specify the beta version(s) you want to use.49544955  - `string`49564957  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`49584959    - `"message-batches-2024-09-24"`49604961    - `"prompt-caching-2024-07-31"`49624963    - `"computer-use-2024-10-22"`49644965    - `"computer-use-2025-01-24"`49664967    - `"pdfs-2024-09-25"`49684969    - `"token-counting-2024-11-01"`49704971    - `"token-efficient-tools-2025-02-19"`49724973    - `"output-128k-2025-02-19"`49744975    - `"files-api-2025-04-14"`49764977    - `"mcp-client-2025-04-04"`49784979    - `"mcp-client-2025-11-20"`49804981    - `"dev-full-thinking-2025-05-14"`49824983    - `"interleaved-thinking-2025-05-14"`49844985    - `"code-execution-2025-05-22"`49864987    - `"extended-cache-ttl-2025-04-11"`49884989    - `"context-1m-2025-08-07"`49904991    - `"context-management-2025-06-27"`49924993    - `"model-context-window-exceeded-2025-08-26"`49944995    - `"skills-2025-10-02"`49964997    - `"fast-mode-2026-02-01"`49984999    - `"output-300k-2026-03-24"`50005001    - `"user-profiles-2026-03-24"`50025003    - `"user-profiles-2026-08-18"`50045005    - `"user-profiles-2026-09-04"`50065007    - `"advisor-tool-2026-03-01"`50085009    - `"managed-agents-2026-04-01"`50105011    - `"cache-diagnosis-2026-04-07"`50125013    - `"dreaming-2026-04-21"`50145015    - `"thinking-token-count-2026-05-13"`50165017    - `"server-side-fallback-2026-06-01"`50185019    - `"server-side-fallback-2026-07-01"`50205021    - `"fallback-credit-2026-06-01"`50225023    - `"fallback-credit-2026-07-01"`50245025    - `"agent-memory-2026-07-22"`50265027    - `"mid-conversation-tool-changes-2026-07-01"`50285029    - `"compact-2026-01-12"`50305031    - `"computer-use-2025-11-24"`50325033    - `"mcp-tunnels-2026-06-22"`50345035    - `"structured-outputs-2025-11-13"`50365037    - `"task-budgets-2026-03-13"`50385039    - `"thinking-display-updates-2026-08-18"`50405041    - `"ce-user-management-2026-07-13"`50425043    - `"mid-conversation-output-config-2026-07-01"`50445045    - `"thinking-binding-controls-2026-08-01"`50465047    - `"mid-conversation-system-clear-at-2026-08-21"`50485049    - `"compact-2026-09-04"`50505051#### Body parameters50525053- `workspace_id: string`50545055  Tagged ID of the workspace to enable this rule for.50565057#### Returns50585059- `BetaFederationRuleWorkspace object`50605061  - `type: "federation_rule_workspace"`50625063    default: federation_rule_workspace50645065  - `created_at: string`50665067    When this workspace was enabled for the rule.50685069    format: date-time50705071  - `created_by_actor_id: string or null`50725073    Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.50745075  - `federation_rule_id: string`50765077    Tagged ID of the federation rule.50785079  - `workspace_id: string`50805081    Tagged ID of the workspace this rule is enabled for.50825083  - `workspace_name: string or null`50845085    Workspace display name. Populated when listing; null in the enable response.50865087#### Example50885089```bash5090curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \5091    -H 'Content-Type: application/json' \5092    -H 'anthropic-version: 2023-06-01' \5093    -H "X-Api-Key: $ANTHROPIC_API_KEY" \5094    -d '{5095          "workspace_id": "workspace_id"5096        }'5097```50985099##### Response (200)51005101```json5102{5103  "created_at": "2024-10-30T23:58:27.427722Z",5104  "created_by_actor_id": "created_by_actor_id",5105  "federation_rule_id": "federation_rule_id",5106  "type": "federation_rule_workspace",5107  "workspace_id": "workspace_id",5108  "workspace_name": "workspace_name"5109}5110```51115112### List Federation Rule Workspaces51135114**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`51155116**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).51175118List workspaces where this federation rule is enabled.51195120Returns all workspace enablements in a single response; the `limit` and5121`page` parameters are accepted but have no effect, and `next_page` is5122always `null`. Returns explicit per-workspace enablements only; for5123rules with `applies_to_all_workspaces` or a legacy single5124`workspace_id`, check those fields on the rule itself.51255126#### Path parameters51275128- `federation_rule_id: string`51295130  ID of the federation rule.51315132#### Query parameters51335134- `limit: optional number`51355136  Number of results per page.51375138  default: 20, maximum: 100, minimum: 151395140- `page: optional string`51415142  Opaque cursor from a previous response's `next_page`.51435144#### Headers51455146- `"anthropic-beta": optional array of AnthropicBeta`51475148  Optional header to specify the beta version(s) you want to use.51495150  - `string`51515152  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`51535154    - `"message-batches-2024-09-24"`51555156    - `"prompt-caching-2024-07-31"`51575158    - `"computer-use-2024-10-22"`51595160    - `"computer-use-2025-01-24"`51615162    - `"pdfs-2024-09-25"`51635164    - `"token-counting-2024-11-01"`51655166    - `"token-efficient-tools-2025-02-19"`51675168    - `"output-128k-2025-02-19"`51695170    - `"files-api-2025-04-14"`51715172    - `"mcp-client-2025-04-04"`51735174    - `"mcp-client-2025-11-20"`51755176    - `"dev-full-thinking-2025-05-14"`51775178    - `"interleaved-thinking-2025-05-14"`51795180    - `"code-execution-2025-05-22"`51815182    - `"extended-cache-ttl-2025-04-11"`51835184    - `"context-1m-2025-08-07"`51855186    - `"context-management-2025-06-27"`51875188    - `"model-context-window-exceeded-2025-08-26"`51895190    - `"skills-2025-10-02"`51915192    - `"fast-mode-2026-02-01"`51935194    - `"output-300k-2026-03-24"`51955196    - `"user-profiles-2026-03-24"`51975198    - `"user-profiles-2026-08-18"`51995200    - `"user-profiles-2026-09-04"`52015202    - `"advisor-tool-2026-03-01"`52035204    - `"managed-agents-2026-04-01"`52055206    - `"cache-diagnosis-2026-04-07"`52075208    - `"dreaming-2026-04-21"`52095210    - `"thinking-token-count-2026-05-13"`52115212    - `"server-side-fallback-2026-06-01"`52135214    - `"server-side-fallback-2026-07-01"`52155216    - `"fallback-credit-2026-06-01"`52175218    - `"fallback-credit-2026-07-01"`52195220    - `"agent-memory-2026-07-22"`52215222    - `"mid-conversation-tool-changes-2026-07-01"`52235224    - `"compact-2026-01-12"`52255226    - `"computer-use-2025-11-24"`52275228    - `"mcp-tunnels-2026-06-22"`52295230    - `"structured-outputs-2025-11-13"`52315232    - `"task-budgets-2026-03-13"`52335234    - `"thinking-display-updates-2026-08-18"`52355236    - `"ce-user-management-2026-07-13"`52375238    - `"mid-conversation-output-config-2026-07-01"`52395240    - `"thinking-binding-controls-2026-08-01"`52415242    - `"mid-conversation-system-clear-at-2026-08-21"`52435244    - `"compact-2026-09-04"`52455246#### Returns52475248- `data: array of BetaFederationRuleWorkspace`52495250  - `type: "federation_rule_workspace"`52515252    default: federation_rule_workspace52535254  - `created_at: string`52555256    When this workspace was enabled for the rule.52575258    format: date-time52595260  - `created_by_actor_id: string or null`52615262    Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.52635264  - `federation_rule_id: string`52655266    Tagged ID of the federation rule.52675268  - `workspace_id: string`52695270    Tagged ID of the workspace this rule is enabled for.52715272  - `workspace_name: string or null`52735274    Workspace display name. Populated when listing; null in the enable response.52755276- `next_page: string or null`52775278  Opaque cursor for the next page; null when there are no more results.52795280#### Example52815282```bash5283curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \5284    -H 'anthropic-version: 2023-06-01' \5285    -H "X-Api-Key: $ANTHROPIC_API_KEY"5286```52875288##### Response (200)52895290```json5291{5292  "data": [5293    {5294      "created_at": "2024-10-30T23:58:27.427722Z",5295      "created_by_actor_id": "created_by_actor_id",5296      "federation_rule_id": "federation_rule_id",5297      "type": "federation_rule_workspace",5298      "workspace_id": "workspace_id",5299      "workspace_name": "workspace_name"5300    }5301  ],5302  "next_page": "next_page"5303}5304```53055306### Remove Federation Rule Workspace53075308**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`53095310**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).53115312Disable a federation rule for a workspace.53135314Idempotent; succeeds even if the enablement was already removed. OAuth5315callers may only manage rules whose `oauth_scope` is5316`workspace:developer` or `workspace:inference`; other scopes require a5317Console session.53185319#### Path parameters53205321- `federation_rule_id: string`53225323  ID of the federation rule.53245325- `workspace_id: string`53265327  ID of the workspace to disable for.53285329#### Headers53305331- `"anthropic-beta": optional array of AnthropicBeta`53325333  Optional header to specify the beta version(s) you want to use.53345335  - `string`53365337  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`53385339    - `"message-batches-2024-09-24"`53405341    - `"prompt-caching-2024-07-31"`53425343    - `"computer-use-2024-10-22"`53445345    - `"computer-use-2025-01-24"`53465347    - `"pdfs-2024-09-25"`53485349    - `"token-counting-2024-11-01"`53505351    - `"token-efficient-tools-2025-02-19"`53525353    - `"output-128k-2025-02-19"`53545355    - `"files-api-2025-04-14"`53565357    - `"mcp-client-2025-04-04"`53585359    - `"mcp-client-2025-11-20"`53605361    - `"dev-full-thinking-2025-05-14"`53625363    - `"interleaved-thinking-2025-05-14"`53645365    - `"code-execution-2025-05-22"`53665367    - `"extended-cache-ttl-2025-04-11"`53685369    - `"context-1m-2025-08-07"`53705371    - `"context-management-2025-06-27"`53725373    - `"model-context-window-exceeded-2025-08-26"`53745375    - `"skills-2025-10-02"`53765377    - `"fast-mode-2026-02-01"`53785379    - `"output-300k-2026-03-24"`53805381    - `"user-profiles-2026-03-24"`53825383    - `"user-profiles-2026-08-18"`53845385    - `"user-profiles-2026-09-04"`53865387    - `"advisor-tool-2026-03-01"`53885389    - `"managed-agents-2026-04-01"`53905391    - `"cache-diagnosis-2026-04-07"`53925393    - `"dreaming-2026-04-21"`53945395    - `"thinking-token-count-2026-05-13"`53965397    - `"server-side-fallback-2026-06-01"`53985399    - `"server-side-fallback-2026-07-01"`54005401    - `"fallback-credit-2026-06-01"`54025403    - `"fallback-credit-2026-07-01"`54045405    - `"agent-memory-2026-07-22"`54065407    - `"mid-conversation-tool-changes-2026-07-01"`54085409    - `"compact-2026-01-12"`54105411    - `"computer-use-2025-11-24"`54125413    - `"mcp-tunnels-2026-06-22"`54145415    - `"structured-outputs-2025-11-13"`54165417    - `"task-budgets-2026-03-13"`54185419    - `"thinking-display-updates-2026-08-18"`54205421    - `"ce-user-management-2026-07-13"`54225423    - `"mid-conversation-output-config-2026-07-01"`54245425    - `"thinking-binding-controls-2026-08-01"`54265427    - `"mid-conversation-system-clear-at-2026-08-21"`54285429    - `"compact-2026-09-04"`54305431#### Returns54325433- `type: "federation_rule_workspace_deleted"`54345435  default: federation_rule_workspace_deleted54365437- `federation_rule_id: string`54385439  Tagged ID of the federation rule.54405441- `workspace_id: string`54425443  Tagged ID of the workspace named in the delete request. Removal is idempotent.54445445#### Example54465447```bash5448curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \5449    -X DELETE \5450    -H 'anthropic-version: 2023-06-01' \5451    -H "X-Api-Key: $ANTHROPIC_API_KEY"5452```54535454##### Response (200)54555456```json5457{5458  "federation_rule_id": "federation_rule_id",5459  "type": "federation_rule_workspace_deleted",5460  "workspace_id": "workspace_id"5461}5462```54635464## Organization › Invites54655466### Create Invite54675468**POST** `/v1/organizations/invites`54695470Invite a user to join the organization by email.54715472On plans that draw members from a finite pool of purchased seats, the invite automatically consumes a seat from the lowest tier with availability; there is no seat-tier parameter. When no seat is free the request fails with a 400 error rather than purchasing a seat.54735474#### Body parameters54755476- `email: string`54775478  Email of the User.54795480  format: email54815482- `role: "billing" or "claude_code_user" or "developer" or 2 more`54835484  Role for the invited User.54855486  The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations accept `user` and `managed`.54875488  - `"billing"`54895490  - `"claude_code_user"`54915492  - `"developer"`54935494  - `"managed"`54955496  - `"user"`54975498- `rbac_group_ids: optional array of string`54995500  RBAC group IDs to assign to the User when the Invite is accepted. A non-empty array is accepted only for a Claude Enterprise organization with RBAC groups, and requires the key to carry the `write:rbac_groups` scope.55015502  maxItems: 10055035504#### Returns55055506- `BetaOrganizationInvite object`55075508  - `type: "invite"`55095510    Object type.55115512    For Invites, this is always `"invite"`.55135514    default: invite55155516  - `id: string`55175518    ID of the Invite.55195520  - `accepted_at: string or null`55215522    RFC 3339 datetime string indicating when the Invite was accepted, or null.55235524    format: date-time55255526  - `email: string`55275528    Email of the User being invited.55295530  - `expires_at: string`55315532    RFC 3339 datetime string indicating when the Invite expires.55335534    format: date-time55355536  - `invited_at: string`55375538    RFC 3339 datetime string indicating when the Invite was created.55395540    format: date-time55415542  - `rbac_group_ids: array of string`55435544    RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.55455546  - `role: BetaOrganizationRole`55475548    Organization role of the User.55495550    - `"admin"`55515552    - `"billing"`55535554    - `"claude_code_user"`55555556    - `"developer"`55575558    - `"managed"`55595560    - `"membership_admin"`55615562    - `"owner"`55635564    - `"primary_owner"`55655566    - `"user"`55675568  - `status: "accepted" or "deleted" or "expired" or "pending"`55695570    Status of the Invite.55715572    - `"accepted"`55735574    - `"deleted"`55755576    - `"expired"`55775578    - `"pending"`55795580#### Example55815582```bash5583curl https://api.anthropic.com/v1/organizations/invites \5584    -H 'Content-Type: application/json' \5585    -H 'anthropic-version: 2023-06-01' \5586    -H "X-Api-Key: $ANTHROPIC_API_KEY" \5587    -d '{5588          "email": "user@emaildomain.com",5589          "role": "user"5590        }'5591```55925593##### Response (200)55945595```json5596{5597  "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",5598  "accepted_at": "2019-12-27T18:11:19.117Z",5599  "email": "user@emaildomain.com",5600  "expires_at": "2024-11-20T23:58:27.427722Z",5601  "invited_at": "2024-10-30T23:58:27.427722Z",5602  "rbac_group_ids": [5603    "string"5604  ],5605  "role": "admin",5606  "status": "pending",5607  "type": "invite"5608}5609```56105611### List Invites56125613**GET** `/v1/organizations/invites`56145615List the organization's invites.56165617#### Query parameters56185619- `after_id: optional string`56205621  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.56225623- `before_id: optional string`56245625  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.56265627- `email: optional string`56285629  Filter by the email address the Invite was sent to. Matches the same way as the Users list's `email` filter (normalized, case-insensitive).56305631  format: email56325633- `limit: optional number`56345635  Number of items to return per page.56365637  Defaults to `20`. Ranges from `1` to `1000`.56385639  default: 20, maximum: 1000, minimum: 156405641- `roles: optional array of string`56425643  Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together.56445645  Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`.56465647- `statuses: optional array of "accepted" or "expired" or "pending"`56485649  Filter by Invite status. Repeatable; values are OR'ed together. Omit to return `pending`, `accepted`, and `expired` Invites alike.56505651  - `"accepted"`56525653  - `"expired"`56545655  - `"pending"`56565657#### Returns56585659- `data: array of BetaOrganizationInvite`56605661  - `type: "invite"`56625663    Object type.56645665    For Invites, this is always `"invite"`.56665667    default: invite56685669  - `id: string`56705671    ID of the Invite.56725673  - `accepted_at: string or null`56745675    RFC 3339 datetime string indicating when the Invite was accepted, or null.56765677    format: date-time56785679  - `email: string`56805681    Email of the User being invited.56825683  - `expires_at: string`56845685    RFC 3339 datetime string indicating when the Invite expires.56865687    format: date-time56885689  - `invited_at: string`56905691    RFC 3339 datetime string indicating when the Invite was created.56925693    format: date-time56945695  - `rbac_group_ids: array of string`56965697    RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.56985699  - `role: BetaOrganizationRole`57005701    Organization role of the User.57025703    - `"admin"`57045705    - `"billing"`57065707    - `"claude_code_user"`57085709    - `"developer"`57105711    - `"managed"`57125713    - `"membership_admin"`57145715    - `"owner"`57165717    - `"primary_owner"`57185719    - `"user"`57205721  - `status: "accepted" or "deleted" or "expired" or "pending"`57225723    Status of the Invite.57245725    - `"accepted"`57265727    - `"deleted"`57285729    - `"expired"`57305731    - `"pending"`57325733- `first_id: string or null`57345735  First ID in the `data` list. Can be used as the `before_id` for the previous page.57365737- `has_more: boolean`57385739  Indicates if there are more results in the requested page direction.57405741- `last_id: string or null`57425743  Last ID in the `data` list. Can be used as the `after_id` for the next page.57445745#### Example57465747```bash5748curl https://api.anthropic.com/v1/organizations/invites \5749    -H 'anthropic-version: 2023-06-01' \5750    -H "X-Api-Key: $ANTHROPIC_API_KEY"5751```57525753##### Response (200)57545755```json5756{5757  "data": [5758    {5759      "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",5760      "accepted_at": "2019-12-27T18:11:19.117Z",5761      "email": "user@emaildomain.com",5762      "expires_at": "2024-11-20T23:58:27.427722Z",5763      "invited_at": "2024-10-30T23:58:27.427722Z",5764      "rbac_group_ids": [5765        "string"5766      ],5767      "role": "admin",5768      "status": "pending",5769      "type": "invite"5770    }5771  ],5772  "first_id": "first_id",5773  "has_more": true,5774  "last_id": "last_id"5775}5776```57775778### Get Invite57795780**GET** `/v1/organizations/invites/{invite_id}`57815782Retrieve an invite by ID.57835784#### Path parameters57855786- `invite_id: string`57875788  ID of the Invite.57895790#### Returns57915792- `BetaOrganizationInvite object`57935794  - `type: "invite"`57955796    Object type.57975798    For Invites, this is always `"invite"`.57995800    default: invite58015802  - `id: string`58035804    ID of the Invite.58055806  - `accepted_at: string or null`58075808    RFC 3339 datetime string indicating when the Invite was accepted, or null.58095810    format: date-time58115812  - `email: string`58135814    Email of the User being invited.58155816  - `expires_at: string`58175818    RFC 3339 datetime string indicating when the Invite expires.58195820    format: date-time58215822  - `invited_at: string`58235824    RFC 3339 datetime string indicating when the Invite was created.58255826    format: date-time58275828  - `rbac_group_ids: array of string`58295830    RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.58315832  - `role: BetaOrganizationRole`58335834    Organization role of the User.58355836    - `"admin"`58375838    - `"billing"`58395840    - `"claude_code_user"`58415842    - `"developer"`58435844    - `"managed"`58455846    - `"membership_admin"`58475848    - `"owner"`58495850    - `"primary_owner"`58515852    - `"user"`58535854  - `status: "accepted" or "deleted" or "expired" or "pending"`58555856    Status of the Invite.58575858    - `"accepted"`58595860    - `"deleted"`58615862    - `"expired"`58635864    - `"pending"`58655866#### Example58675868```bash5869curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \5870    -H 'anthropic-version: 2023-06-01' \5871    -H "X-Api-Key: $ANTHROPIC_API_KEY"5872```58735874##### Response (200)58755876```json5877{5878  "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",5879  "accepted_at": "2019-12-27T18:11:19.117Z",5880  "email": "user@emaildomain.com",5881  "expires_at": "2024-11-20T23:58:27.427722Z",5882  "invited_at": "2024-10-30T23:58:27.427722Z",5883  "rbac_group_ids": [5884    "string"5885  ],5886  "role": "admin",5887  "status": "pending",5888  "type": "invite"5889}5890```58915892### Delete Invite58935894**DELETE** `/v1/organizations/invites/{invite_id}`58955896Delete a pending invite.58975898#### Path parameters58995900- `invite_id: string`59015902  ID of the Invite.59035904#### Returns59055906- `type: "invite_deleted"`59075908  Deleted object type.59095910  For Invites, this is always `"invite_deleted"`.59115912  default: invite_deleted59135914- `id: string`59155916  ID of the Invite.59175918#### Example59195920```bash5921curl https://api.anthropic.com/v1/organizations/invites/$INVITE_ID \5922    -X DELETE \5923    -H 'anthropic-version: 2023-06-01' \5924    -H "X-Api-Key: $ANTHROPIC_API_KEY"5925```59265927##### Response (200)59285929```json5930{5931  "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",5932  "type": "invite_deleted"5933}5934```59355936## Organization › Service Accounts59375938### Create Service Account59395940**POST** `/v1/organizations/service_accounts`59415942**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).59435944Create a service account.59455946A service account is a named workload identity that federation rules5947target. `organization_role` is `developer` (default) or `admin`; a rule5948may only be created or retargeted to grant `org:admin` scope when the5949target's `organization_role` is `admin`. Creating an `admin`-role service5950account requires an interactive credential (a user OAuth token or a5951Console session) — a workload may only create `developer`-role service5952accounts.59535954#### Headers59555956- `"anthropic-beta": optional array of AnthropicBeta`59575958  Optional header to specify the beta version(s) you want to use.59595960  - `string`59615962  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`59635964    - `"message-batches-2024-09-24"`59655966    - `"prompt-caching-2024-07-31"`59675968    - `"computer-use-2024-10-22"`59695970    - `"computer-use-2025-01-24"`59715972    - `"pdfs-2024-09-25"`59735974    - `"token-counting-2024-11-01"`59755976    - `"token-efficient-tools-2025-02-19"`59775978    - `"output-128k-2025-02-19"`59795980    - `"files-api-2025-04-14"`59815982    - `"mcp-client-2025-04-04"`59835984    - `"mcp-client-2025-11-20"`59855986    - `"dev-full-thinking-2025-05-14"`59875988    - `"interleaved-thinking-2025-05-14"`59895990    - `"code-execution-2025-05-22"`59915992    - `"extended-cache-ttl-2025-04-11"`59935994    - `"context-1m-2025-08-07"`59955996    - `"context-management-2025-06-27"`59975998    - `"model-context-window-exceeded-2025-08-26"`59996000    - `"skills-2025-10-02"`60016002    - `"fast-mode-2026-02-01"`60036004    - `"output-300k-2026-03-24"`60056006    - `"user-profiles-2026-03-24"`60076008    - `"user-profiles-2026-08-18"`60096010    - `"user-profiles-2026-09-04"`60116012    - `"advisor-tool-2026-03-01"`60136014    - `"managed-agents-2026-04-01"`60156016    - `"cache-diagnosis-2026-04-07"`60176018    - `"dreaming-2026-04-21"`60196020    - `"thinking-token-count-2026-05-13"`60216022    - `"server-side-fallback-2026-06-01"`60236024    - `"server-side-fallback-2026-07-01"`60256026    - `"fallback-credit-2026-06-01"`60276028    - `"fallback-credit-2026-07-01"`60296030    - `"agent-memory-2026-07-22"`60316032    - `"mid-conversation-tool-changes-2026-07-01"`60336034    - `"compact-2026-01-12"`60356036    - `"computer-use-2025-11-24"`60376038    - `"mcp-tunnels-2026-06-22"`60396040    - `"structured-outputs-2025-11-13"`60416042    - `"task-budgets-2026-03-13"`60436044    - `"thinking-display-updates-2026-08-18"`60456046    - `"ce-user-management-2026-07-13"`60476048    - `"mid-conversation-output-config-2026-07-01"`60496050    - `"thinking-binding-controls-2026-08-01"`60516052    - `"mid-conversation-system-clear-at-2026-08-21"`60536054    - `"compact-2026-09-04"`60556056#### Body parameters60576058- `name: string`60596060  Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.60616062  maxLength: 255, minLength: 160636064- `description: optional string or null`60656066  Optional free-text description.60676068  maxLength: 200060696070- `organization_role: optional "admin" or "developer"`60716072  Org-level role. Defaults to `developer`.60736074  - `"admin"`60756076  - `"developer"`60776078#### Returns60796080- `BetaServiceAccount object`60816082  Named non-human identity within the caller's organization.60836084  A service account is a pure identity: name + org. Authorization lives on6085  whatever references it (federation rules).60866087  - `type: "service_account"`60886089    default: service_account60906091  - `id: string`60926093    Tagged ID of the service account.60946095  - `archived_at: string or null`60966097    If set, this service account is archived.60986099    format: date-time61006101  - `archived_by_actor_id: string or null`61026103    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.61046105  - `created_at: string`61066107    When this service account was created.61086109    format: date-time61106111  - `created_by_actor_id: string or null`61126113    Tagged ID (`user_`/`svac_`) of the actor that created this service account.61146115  - `description: string or null`61166117    Optional free-text description.61186119  - `name: string`61206121    Admin-chosen slug identifier.61226123  - `organization_role: "admin" or "developer"`61246125    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.61266127    - `"admin"`61286129    - `"developer"`61306131  - `updated_at: string`61326133    When this service account was last updated.61346135    format: date-time61366137  - `updated_by_actor_id: string or null`61386139    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.61406141#### Example61426143```bash6144curl https://api.anthropic.com/v1/organizations/service_accounts \6145    -H 'Content-Type: application/json' \6146    -H 'anthropic-version: 2023-06-01' \6147    -H "X-Api-Key: $ANTHROPIC_API_KEY" \6148    -d '{6149          "name": "ci-deploy-bot"6150        }'6151```61526153##### Response (200)61546155```json6156{6157  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",6158  "archived_at": "2019-12-27T18:11:19.117Z",6159  "archived_by_actor_id": "archived_by_actor_id",6160  "created_at": "2024-10-30T23:58:27.427722Z",6161  "created_by_actor_id": "created_by_actor_id",6162  "description": "description",6163  "name": "ci-deploy-bot",6164  "organization_role": "admin",6165  "type": "service_account",6166  "updated_at": "2024-10-30T23:58:27.427722Z",6167  "updated_by_actor_id": "updated_by_actor_id"6168}6169```61706171### List Service Accounts61726173**GET** `/v1/organizations/service_accounts`61746175**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).61766177List service accounts in the caller's organization.61786179Results are ordered by creation time, newest first. Use `limit` and the6180`next_page` cursor to paginate; set `include_archived=true` to include6181archived service accounts.61826183#### Query parameters61846185- `include_archived: optional boolean`61866187  Include archived resources. Defaults to false.61886189  default: false61906191- `limit: optional number`61926193  Number of results per page.61946195  default: 20, maximum: 100, minimum: 161966197- `page: optional string`61986199  Opaque cursor from a previous response's `next_page`.62006201#### Headers62026203- `"anthropic-beta": optional array of AnthropicBeta`62046205  Optional header to specify the beta version(s) you want to use.62066207  - `string`62086209  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`62106211    - `"message-batches-2024-09-24"`62126213    - `"prompt-caching-2024-07-31"`62146215    - `"computer-use-2024-10-22"`62166217    - `"computer-use-2025-01-24"`62186219    - `"pdfs-2024-09-25"`62206221    - `"token-counting-2024-11-01"`62226223    - `"token-efficient-tools-2025-02-19"`62246225    - `"output-128k-2025-02-19"`62266227    - `"files-api-2025-04-14"`62286229    - `"mcp-client-2025-04-04"`62306231    - `"mcp-client-2025-11-20"`62326233    - `"dev-full-thinking-2025-05-14"`62346235    - `"interleaved-thinking-2025-05-14"`62366237    - `"code-execution-2025-05-22"`62386239    - `"extended-cache-ttl-2025-04-11"`62406241    - `"context-1m-2025-08-07"`62426243    - `"context-management-2025-06-27"`62446245    - `"model-context-window-exceeded-2025-08-26"`62466247    - `"skills-2025-10-02"`62486249    - `"fast-mode-2026-02-01"`62506251    - `"output-300k-2026-03-24"`62526253    - `"user-profiles-2026-03-24"`62546255    - `"user-profiles-2026-08-18"`62566257    - `"user-profiles-2026-09-04"`62586259    - `"advisor-tool-2026-03-01"`62606261    - `"managed-agents-2026-04-01"`62626263    - `"cache-diagnosis-2026-04-07"`62646265    - `"dreaming-2026-04-21"`62666267    - `"thinking-token-count-2026-05-13"`62686269    - `"server-side-fallback-2026-06-01"`62706271    - `"server-side-fallback-2026-07-01"`62726273    - `"fallback-credit-2026-06-01"`62746275    - `"fallback-credit-2026-07-01"`62766277    - `"agent-memory-2026-07-22"`62786279    - `"mid-conversation-tool-changes-2026-07-01"`62806281    - `"compact-2026-01-12"`62826283    - `"computer-use-2025-11-24"`62846285    - `"mcp-tunnels-2026-06-22"`62866287    - `"structured-outputs-2025-11-13"`62886289    - `"task-budgets-2026-03-13"`62906291    - `"thinking-display-updates-2026-08-18"`62926293    - `"ce-user-management-2026-07-13"`62946295    - `"mid-conversation-output-config-2026-07-01"`62966297    - `"thinking-binding-controls-2026-08-01"`62986299    - `"mid-conversation-system-clear-at-2026-08-21"`63006301    - `"compact-2026-09-04"`63026303#### Returns63046305- `data: array of BetaServiceAccount`63066307  - `type: "service_account"`63086309    default: service_account63106311  - `id: string`63126313    Tagged ID of the service account.63146315  - `archived_at: string or null`63166317    If set, this service account is archived.63186319    format: date-time63206321  - `archived_by_actor_id: string or null`63226323    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.63246325  - `created_at: string`63266327    When this service account was created.63286329    format: date-time63306331  - `created_by_actor_id: string or null`63326333    Tagged ID (`user_`/`svac_`) of the actor that created this service account.63346335  - `description: string or null`63366337    Optional free-text description.63386339  - `name: string`63406341    Admin-chosen slug identifier.63426343  - `organization_role: "admin" or "developer"`63446345    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.63466347    - `"admin"`63486349    - `"developer"`63506351  - `updated_at: string`63526353    When this service account was last updated.63546355    format: date-time63566357  - `updated_by_actor_id: string or null`63586359    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.63606361- `next_page: string or null`63626363  Opaque cursor for the next page, or null if no more results.63646365#### Example63666367```bash6368curl https://api.anthropic.com/v1/organizations/service_accounts \6369    -H 'anthropic-version: 2023-06-01' \6370    -H "X-Api-Key: $ANTHROPIC_API_KEY"6371```63726373##### Response (200)63746375```json6376{6377  "data": [6378    {6379      "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",6380      "archived_at": "2019-12-27T18:11:19.117Z",6381      "archived_by_actor_id": "archived_by_actor_id",6382      "created_at": "2024-10-30T23:58:27.427722Z",6383      "created_by_actor_id": "created_by_actor_id",6384      "description": "description",6385      "name": "ci-deploy-bot",6386      "organization_role": "admin",6387      "type": "service_account",6388      "updated_at": "2024-10-30T23:58:27.427722Z",6389      "updated_by_actor_id": "updated_by_actor_id"6390    }6391  ],6392  "next_page": "next_page"6393}6394```63956396### Get Service Account63976398**GET** `/v1/organizations/service_accounts/{service_account_id}`63996400**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).64016402Retrieve a service account by its ID (`svac_...`).64036404#### Path parameters64056406- `service_account_id: string`64076408  ID of the service account.64096410#### Headers64116412- `"anthropic-beta": optional array of AnthropicBeta`64136414  Optional header to specify the beta version(s) you want to use.64156416  - `string`64176418  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`64196420    - `"message-batches-2024-09-24"`64216422    - `"prompt-caching-2024-07-31"`64236424    - `"computer-use-2024-10-22"`64256426    - `"computer-use-2025-01-24"`64276428    - `"pdfs-2024-09-25"`64296430    - `"token-counting-2024-11-01"`64316432    - `"token-efficient-tools-2025-02-19"`64336434    - `"output-128k-2025-02-19"`64356436    - `"files-api-2025-04-14"`64376438    - `"mcp-client-2025-04-04"`64396440    - `"mcp-client-2025-11-20"`64416442    - `"dev-full-thinking-2025-05-14"`64436444    - `"interleaved-thinking-2025-05-14"`64456446    - `"code-execution-2025-05-22"`64476448    - `"extended-cache-ttl-2025-04-11"`64496450    - `"context-1m-2025-08-07"`64516452    - `"context-management-2025-06-27"`64536454    - `"model-context-window-exceeded-2025-08-26"`64556456    - `"skills-2025-10-02"`64576458    - `"fast-mode-2026-02-01"`64596460    - `"output-300k-2026-03-24"`64616462    - `"user-profiles-2026-03-24"`64636464    - `"user-profiles-2026-08-18"`64656466    - `"user-profiles-2026-09-04"`64676468    - `"advisor-tool-2026-03-01"`64696470    - `"managed-agents-2026-04-01"`64716472    - `"cache-diagnosis-2026-04-07"`64736474    - `"dreaming-2026-04-21"`64756476    - `"thinking-token-count-2026-05-13"`64776478    - `"server-side-fallback-2026-06-01"`64796480    - `"server-side-fallback-2026-07-01"`64816482    - `"fallback-credit-2026-06-01"`64836484    - `"fallback-credit-2026-07-01"`64856486    - `"agent-memory-2026-07-22"`64876488    - `"mid-conversation-tool-changes-2026-07-01"`64896490    - `"compact-2026-01-12"`64916492    - `"computer-use-2025-11-24"`64936494    - `"mcp-tunnels-2026-06-22"`64956496    - `"structured-outputs-2025-11-13"`64976498    - `"task-budgets-2026-03-13"`64996500    - `"thinking-display-updates-2026-08-18"`65016502    - `"ce-user-management-2026-07-13"`65036504    - `"mid-conversation-output-config-2026-07-01"`65056506    - `"thinking-binding-controls-2026-08-01"`65076508    - `"mid-conversation-system-clear-at-2026-08-21"`65096510    - `"compact-2026-09-04"`65116512#### Returns65136514- `BetaServiceAccount object`65156516  Named non-human identity within the caller's organization.65176518  A service account is a pure identity: name + org. Authorization lives on6519  whatever references it (federation rules).65206521  - `type: "service_account"`65226523    default: service_account65246525  - `id: string`65266527    Tagged ID of the service account.65286529  - `archived_at: string or null`65306531    If set, this service account is archived.65326533    format: date-time65346535  - `archived_by_actor_id: string or null`65366537    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.65386539  - `created_at: string`65406541    When this service account was created.65426543    format: date-time65446545  - `created_by_actor_id: string or null`65466547    Tagged ID (`user_`/`svac_`) of the actor that created this service account.65486549  - `description: string or null`65506551    Optional free-text description.65526553  - `name: string`65546555    Admin-chosen slug identifier.65566557  - `organization_role: "admin" or "developer"`65586559    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.65606561    - `"admin"`65626563    - `"developer"`65646565  - `updated_at: string`65666567    When this service account was last updated.65686569    format: date-time65706571  - `updated_by_actor_id: string or null`65726573    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.65746575#### Example65766577```bash6578curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID \6579    -H 'anthropic-version: 2023-06-01' \6580    -H "X-Api-Key: $ANTHROPIC_API_KEY"6581```65826583##### Response (200)65846585```json6586{6587  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",6588  "archived_at": "2019-12-27T18:11:19.117Z",6589  "archived_by_actor_id": "archived_by_actor_id",6590  "created_at": "2024-10-30T23:58:27.427722Z",6591  "created_by_actor_id": "created_by_actor_id",6592  "description": "description",6593  "name": "ci-deploy-bot",6594  "organization_role": "admin",6595  "type": "service_account",6596  "updated_at": "2024-10-30T23:58:27.427722Z",6597  "updated_by_actor_id": "updated_by_actor_id"6598}6599```66006601### Update Service Account66026603**POST** `/v1/organizations/service_accounts/{service_account_id}`66046605**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).66066607Update a service account.66086609Only `description` and `organization_role` are mutable; `name` cannot be6610changed. Archived service accounts cannot be updated; this returns 400.6611Setting `organization_role` to `admin` (even when unchanged) requires an6612interactive credential (a user OAuth token or a Console session).66136614#### Path parameters66156616- `service_account_id: string`66176618  ID of the service account to update.66196620#### Headers66216622- `"anthropic-beta": optional array of AnthropicBeta`66236624  Optional header to specify the beta version(s) you want to use.66256626  - `string`66276628  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`66296630    - `"message-batches-2024-09-24"`66316632    - `"prompt-caching-2024-07-31"`66336634    - `"computer-use-2024-10-22"`66356636    - `"computer-use-2025-01-24"`66376638    - `"pdfs-2024-09-25"`66396640    - `"token-counting-2024-11-01"`66416642    - `"token-efficient-tools-2025-02-19"`66436644    - `"output-128k-2025-02-19"`66456646    - `"files-api-2025-04-14"`66476648    - `"mcp-client-2025-04-04"`66496650    - `"mcp-client-2025-11-20"`66516652    - `"dev-full-thinking-2025-05-14"`66536654    - `"interleaved-thinking-2025-05-14"`66556656    - `"code-execution-2025-05-22"`66576658    - `"extended-cache-ttl-2025-04-11"`66596660    - `"context-1m-2025-08-07"`66616662    - `"context-management-2025-06-27"`66636664    - `"model-context-window-exceeded-2025-08-26"`66656666    - `"skills-2025-10-02"`66676668    - `"fast-mode-2026-02-01"`66696670    - `"output-300k-2026-03-24"`66716672    - `"user-profiles-2026-03-24"`66736674    - `"user-profiles-2026-08-18"`66756676    - `"user-profiles-2026-09-04"`66776678    - `"advisor-tool-2026-03-01"`66796680    - `"managed-agents-2026-04-01"`66816682    - `"cache-diagnosis-2026-04-07"`66836684    - `"dreaming-2026-04-21"`66856686    - `"thinking-token-count-2026-05-13"`66876688    - `"server-side-fallback-2026-06-01"`66896690    - `"server-side-fallback-2026-07-01"`66916692    - `"fallback-credit-2026-06-01"`66936694    - `"fallback-credit-2026-07-01"`66956696    - `"agent-memory-2026-07-22"`66976698    - `"mid-conversation-tool-changes-2026-07-01"`66996700    - `"compact-2026-01-12"`67016702    - `"computer-use-2025-11-24"`67036704    - `"mcp-tunnels-2026-06-22"`67056706    - `"structured-outputs-2025-11-13"`67076708    - `"task-budgets-2026-03-13"`67096710    - `"thinking-display-updates-2026-08-18"`67116712    - `"ce-user-management-2026-07-13"`67136714    - `"mid-conversation-output-config-2026-07-01"`67156716    - `"thinking-binding-controls-2026-08-01"`67176718    - `"mid-conversation-system-clear-at-2026-08-21"`67196720    - `"compact-2026-09-04"`67216722#### Body parameters67236724- `description: optional string or null`67256726  Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).67276728  maxLength: 200067296730- `organization_role: optional "admin" or "developer" or null`67316732  Replaces the org-level role. Omit or send `null` to leave unchanged.67336734  - `"admin"`67356736  - `"developer"`67376738#### Returns67396740- `BetaServiceAccount object`67416742  Named non-human identity within the caller's organization.67436744  A service account is a pure identity: name + org. Authorization lives on6745  whatever references it (federation rules).67466747  - `type: "service_account"`67486749    default: service_account67506751  - `id: string`67526753    Tagged ID of the service account.67546755  - `archived_at: string or null`67566757    If set, this service account is archived.67586759    format: date-time67606761  - `archived_by_actor_id: string or null`67626763    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.67646765  - `created_at: string`67666767    When this service account was created.67686769    format: date-time67706771  - `created_by_actor_id: string or null`67726773    Tagged ID (`user_`/`svac_`) of the actor that created this service account.67746775  - `description: string or null`67766777    Optional free-text description.67786779  - `name: string`67806781    Admin-chosen slug identifier.67826783  - `organization_role: "admin" or "developer"`67846785    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.67866787    - `"admin"`67886789    - `"developer"`67906791  - `updated_at: string`67926793    When this service account was last updated.67946795    format: date-time67966797  - `updated_by_actor_id: string or null`67986799    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.68006801#### Example68026803```bash6804curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID \6805    -H 'Content-Type: application/json' \6806    -H 'anthropic-version: 2023-06-01' \6807    -H "X-Api-Key: $ANTHROPIC_API_KEY" \6808    -d '{}'6809```68106811##### Response (200)68126813```json6814{6815  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",6816  "archived_at": "2019-12-27T18:11:19.117Z",6817  "archived_by_actor_id": "archived_by_actor_id",6818  "created_at": "2024-10-30T23:58:27.427722Z",6819  "created_by_actor_id": "created_by_actor_id",6820  "description": "description",6821  "name": "ci-deploy-bot",6822  "organization_role": "admin",6823  "type": "service_account",6824  "updated_at": "2024-10-30T23:58:27.427722Z",6825  "updated_by_actor_id": "updated_by_actor_id"6826}6827```68286829### Archive Service Account68306831**POST** `/v1/organizations/service_accounts/{service_account_id}/archive`68326833**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).68346835Archive a service account.68366837Idempotent; re-archiving returns the service account with its original6838`archived_at`. Rejected with 400 if any live (non-archived) federation6839rule still targets this service account, same as issuer archival; archive6840those rules first or change their target to another service account.68416842#### Path parameters68436844- `service_account_id: string`68456846  ID of the service account to archive.68476848#### Headers68496850- `"anthropic-beta": optional array of AnthropicBeta`68516852  Optional header to specify the beta version(s) you want to use.68536854  - `string`68556856  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`68576858    - `"message-batches-2024-09-24"`68596860    - `"prompt-caching-2024-07-31"`68616862    - `"computer-use-2024-10-22"`68636864    - `"computer-use-2025-01-24"`68656866    - `"pdfs-2024-09-25"`68676868    - `"token-counting-2024-11-01"`68696870    - `"token-efficient-tools-2025-02-19"`68716872    - `"output-128k-2025-02-19"`68736874    - `"files-api-2025-04-14"`68756876    - `"mcp-client-2025-04-04"`68776878    - `"mcp-client-2025-11-20"`68796880    - `"dev-full-thinking-2025-05-14"`68816882    - `"interleaved-thinking-2025-05-14"`68836884    - `"code-execution-2025-05-22"`68856886    - `"extended-cache-ttl-2025-04-11"`68876888    - `"context-1m-2025-08-07"`68896890    - `"context-management-2025-06-27"`68916892    - `"model-context-window-exceeded-2025-08-26"`68936894    - `"skills-2025-10-02"`68956896    - `"fast-mode-2026-02-01"`68976898    - `"output-300k-2026-03-24"`68996900    - `"user-profiles-2026-03-24"`69016902    - `"user-profiles-2026-08-18"`69036904    - `"user-profiles-2026-09-04"`69056906    - `"advisor-tool-2026-03-01"`69076908    - `"managed-agents-2026-04-01"`69096910    - `"cache-diagnosis-2026-04-07"`69116912    - `"dreaming-2026-04-21"`69136914    - `"thinking-token-count-2026-05-13"`69156916    - `"server-side-fallback-2026-06-01"`69176918    - `"server-side-fallback-2026-07-01"`69196920    - `"fallback-credit-2026-06-01"`69216922    - `"fallback-credit-2026-07-01"`69236924    - `"agent-memory-2026-07-22"`69256926    - `"mid-conversation-tool-changes-2026-07-01"`69276928    - `"compact-2026-01-12"`69296930    - `"computer-use-2025-11-24"`69316932    - `"mcp-tunnels-2026-06-22"`69336934    - `"structured-outputs-2025-11-13"`69356936    - `"task-budgets-2026-03-13"`69376938    - `"thinking-display-updates-2026-08-18"`69396940    - `"ce-user-management-2026-07-13"`69416942    - `"mid-conversation-output-config-2026-07-01"`69436944    - `"thinking-binding-controls-2026-08-01"`69456946    - `"mid-conversation-system-clear-at-2026-08-21"`69476948    - `"compact-2026-09-04"`69496950#### Returns69516952- `BetaServiceAccount object`69536954  Named non-human identity within the caller's organization.69556956  A service account is a pure identity: name + org. Authorization lives on6957  whatever references it (federation rules).69586959  - `type: "service_account"`69606961    default: service_account69626963  - `id: string`69646965    Tagged ID of the service account.69666967  - `archived_at: string or null`69686969    If set, this service account is archived.69706971    format: date-time69726973  - `archived_by_actor_id: string or null`69746975    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.69766977  - `created_at: string`69786979    When this service account was created.69806981    format: date-time69826983  - `created_by_actor_id: string or null`69846985    Tagged ID (`user_`/`svac_`) of the actor that created this service account.69866987  - `description: string or null`69886989    Optional free-text description.69906991  - `name: string`69926993    Admin-chosen slug identifier.69946995  - `organization_role: "admin" or "developer"`69966997    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.69986999    - `"admin"`70007001    - `"developer"`70027003  - `updated_at: string`70047005    When this service account was last updated.70067007    format: date-time70087009  - `updated_by_actor_id: string or null`70107011    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.70127013#### Example70147015```bash7016curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/archive \7017    -X POST \7018    -H 'anthropic-version: 2023-06-01' \7019    -H "X-Api-Key: $ANTHROPIC_API_KEY"7020```70217022##### Response (200)70237024```json7025{7026  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",7027  "archived_at": "2019-12-27T18:11:19.117Z",7028  "archived_by_actor_id": "archived_by_actor_id",7029  "created_at": "2024-10-30T23:58:27.427722Z",7030  "created_by_actor_id": "created_by_actor_id",7031  "description": "description",7032  "name": "ci-deploy-bot",7033  "organization_role": "admin",7034  "type": "service_account",7035  "updated_at": "2024-10-30T23:58:27.427722Z",7036  "updated_by_actor_id": "updated_by_actor_id"7037}7038```70397040## Organization › Service Accounts › Workspaces70417042### Add Workspace To Service Account70437044**POST** `/v1/organizations/service_accounts/{service_account_id}/workspaces`70457046**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).70477048Add a service account to a workspace with the given `workspace_role`.70497050Mirror of `POST /workspaces/{workspace_id}/service_accounts`, addressed7051from the service-account side; both create the same membership. If the7052service account is already an explicit member of the workspace, its7053`workspace_role` is replaced with the value supplied here. Archived7054workspaces return 400. Archived service accounts cannot be added and are7055rejected.70567057#### Path parameters70587059- `service_account_id: string`70607061  ID of the service account.70627063#### Headers70647065- `"anthropic-beta": optional array of AnthropicBeta`70667067  Optional header to specify the beta version(s) you want to use.70687069  - `string`70707071  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`70727073    - `"message-batches-2024-09-24"`70747075    - `"prompt-caching-2024-07-31"`70767077    - `"computer-use-2024-10-22"`70787079    - `"computer-use-2025-01-24"`70807081    - `"pdfs-2024-09-25"`70827083    - `"token-counting-2024-11-01"`70847085    - `"token-efficient-tools-2025-02-19"`70867087    - `"output-128k-2025-02-19"`70887089    - `"files-api-2025-04-14"`70907091    - `"mcp-client-2025-04-04"`70927093    - `"mcp-client-2025-11-20"`70947095    - `"dev-full-thinking-2025-05-14"`70967097    - `"interleaved-thinking-2025-05-14"`70987099    - `"code-execution-2025-05-22"`71007101    - `"extended-cache-ttl-2025-04-11"`71027103    - `"context-1m-2025-08-07"`71047105    - `"context-management-2025-06-27"`71067107    - `"model-context-window-exceeded-2025-08-26"`71087109    - `"skills-2025-10-02"`71107111    - `"fast-mode-2026-02-01"`71127113    - `"output-300k-2026-03-24"`71147115    - `"user-profiles-2026-03-24"`71167117    - `"user-profiles-2026-08-18"`71187119    - `"user-profiles-2026-09-04"`71207121    - `"advisor-tool-2026-03-01"`71227123    - `"managed-agents-2026-04-01"`71247125    - `"cache-diagnosis-2026-04-07"`71267127    - `"dreaming-2026-04-21"`71287129    - `"thinking-token-count-2026-05-13"`71307131    - `"server-side-fallback-2026-06-01"`71327133    - `"server-side-fallback-2026-07-01"`71347135    - `"fallback-credit-2026-06-01"`71367137    - `"fallback-credit-2026-07-01"`71387139    - `"agent-memory-2026-07-22"`71407141    - `"mid-conversation-tool-changes-2026-07-01"`71427143    - `"compact-2026-01-12"`71447145    - `"computer-use-2025-11-24"`71467147    - `"mcp-tunnels-2026-06-22"`71487149    - `"structured-outputs-2025-11-13"`71507151    - `"task-budgets-2026-03-13"`71527153    - `"thinking-display-updates-2026-08-18"`71547155    - `"ce-user-management-2026-07-13"`71567157    - `"mid-conversation-output-config-2026-07-01"`71587159    - `"thinking-binding-controls-2026-08-01"`71607161    - `"mid-conversation-system-clear-at-2026-08-21"`71627163    - `"compact-2026-09-04"`71647165#### Body parameters71667167- `workspace_id: string`71687169  Tagged workspace ID to add the service account to.71707171- `workspace_role: BetaNoBillingWorkspaceRole`71727173  Role to assign to the service account in this workspace.71747175  - `"workspace_admin"`71767177  - `"workspace_developer"`71787179  - `"workspace_restricted_developer"`71807181  - `"workspace_user"`71827183#### Returns71847185- `BetaServiceAccountWorkspaceMember object`71867187  - `type: "service_account_workspace_member"`71887189    default: service_account_workspace_member71907191  - `created_by_actor_id: string or null`71927193    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.71947195  - `implicit: boolean or null`71967197    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.71987199  - `service_account_id: string`72007201    Tagged service account ID (`svac_...`).72027203  - `workspace_id: string`72047205    Tagged workspace ID (`wrkspc_...`).72067207  - `workspace_role: BetaWorkspaceRole`72087209    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.72107211    - `"workspace_admin"`72127213    - `"workspace_billing"`72147215    - `"workspace_developer"`72167217    - `"workspace_restricted_developer"`72187219    - `"workspace_user"`72207221#### Example72227223```bash7224curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/workspaces \7225    -H 'Content-Type: application/json' \7226    -H 'anthropic-version: 2023-06-01' \7227    -H "X-Api-Key: $ANTHROPIC_API_KEY" \7228    -d '{7229          "workspace_id": "workspace_id",7230          "workspace_role": "workspace_admin"7231        }'7232```72337234##### Response (200)72357236```json7237{7238  "created_by_actor_id": "created_by_actor_id",7239  "implicit": true,7240  "service_account_id": "service_account_id",7241  "type": "service_account_workspace_member",7242  "workspace_id": "workspace_id",7243  "workspace_role": "workspace_admin"7244}7245```72467247### List Workspaces For Service Account72487249**GET** `/v1/organizations/service_accounts/{service_account_id}/workspaces`72507251**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).72527253List the workspaces a service account is a member of.72547255Each entry includes the service account's `workspace_role` in that7256workspace. Use `limit` and the `next_page` cursor to paginate. When the7257service account has no explicit default-workspace membership, the7258implicit (`implicit: true`) membership is returned as the first entry on7259the first page; with `limit=1` the first page may return up to 2 entries7260(the implicit entry plus one explicit membership) so a pagination cursor7261can be derived. Memberships are returned only while7262the service account is active. Without a `page` cursor, an archived7263service account returns an empty list. A `page` cursor that does not7264match an active membership returns a 400 invalid-request error. A cursor7265stops matching when the membership is removed, the workspace is deleted,7266or the service account is archived. Restart pagination from the first7267page to recover.72687269#### Path parameters72707271- `service_account_id: string`72727273  ID of the service account.72747275#### Query parameters72767277- `limit: optional number`72787279  Number of results per page.72807281  default: 20, maximum: 100, minimum: 172827283- `page: optional string`72847285  Opaque cursor from a previous response's `next_page`.72867287#### Headers72887289- `"anthropic-beta": optional array of AnthropicBeta`72907291  Optional header to specify the beta version(s) you want to use.72927293  - `string`72947295  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`72967297    - `"message-batches-2024-09-24"`72987299    - `"prompt-caching-2024-07-31"`73007301    - `"computer-use-2024-10-22"`73027303    - `"computer-use-2025-01-24"`73047305    - `"pdfs-2024-09-25"`73067307    - `"token-counting-2024-11-01"`73087309    - `"token-efficient-tools-2025-02-19"`73107311    - `"output-128k-2025-02-19"`73127313    - `"files-api-2025-04-14"`73147315    - `"mcp-client-2025-04-04"`73167317    - `"mcp-client-2025-11-20"`73187319    - `"dev-full-thinking-2025-05-14"`73207321    - `"interleaved-thinking-2025-05-14"`73227323    - `"code-execution-2025-05-22"`73247325    - `"extended-cache-ttl-2025-04-11"`73267327    - `"context-1m-2025-08-07"`73287329    - `"context-management-2025-06-27"`73307331    - `"model-context-window-exceeded-2025-08-26"`73327333    - `"skills-2025-10-02"`73347335    - `"fast-mode-2026-02-01"`73367337    - `"output-300k-2026-03-24"`73387339    - `"user-profiles-2026-03-24"`73407341    - `"user-profiles-2026-08-18"`73427343    - `"user-profiles-2026-09-04"`73447345    - `"advisor-tool-2026-03-01"`73467347    - `"managed-agents-2026-04-01"`73487349    - `"cache-diagnosis-2026-04-07"`73507351    - `"dreaming-2026-04-21"`73527353    - `"thinking-token-count-2026-05-13"`73547355    - `"server-side-fallback-2026-06-01"`73567357    - `"server-side-fallback-2026-07-01"`73587359    - `"fallback-credit-2026-06-01"`73607361    - `"fallback-credit-2026-07-01"`73627363    - `"agent-memory-2026-07-22"`73647365    - `"mid-conversation-tool-changes-2026-07-01"`73667367    - `"compact-2026-01-12"`73687369    - `"computer-use-2025-11-24"`73707371    - `"mcp-tunnels-2026-06-22"`73727373    - `"structured-outputs-2025-11-13"`73747375    - `"task-budgets-2026-03-13"`73767377    - `"thinking-display-updates-2026-08-18"`73787379    - `"ce-user-management-2026-07-13"`73807381    - `"mid-conversation-output-config-2026-07-01"`73827383    - `"thinking-binding-controls-2026-08-01"`73847385    - `"mid-conversation-system-clear-at-2026-08-21"`73867387    - `"compact-2026-09-04"`73887389#### Returns73907391- `data: array of BetaServiceAccountWorkspaceMember`73927393  - `type: "service_account_workspace_member"`73947395    default: service_account_workspace_member73967397  - `created_by_actor_id: string or null`73987399    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.74007401  - `implicit: boolean or null`74027403    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.74047405  - `service_account_id: string`74067407    Tagged service account ID (`svac_...`).74087409  - `workspace_id: string`74107411    Tagged workspace ID (`wrkspc_...`).74127413  - `workspace_role: BetaWorkspaceRole`74147415    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.74167417    - `"workspace_admin"`74187419    - `"workspace_billing"`74207421    - `"workspace_developer"`74227423    - `"workspace_restricted_developer"`74247425    - `"workspace_user"`74267427- `next_page: string or null`74287429  Opaque cursor for the next page, or null if no more results.74307431#### Example74327433```bash7434curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/workspaces \7435    -H 'anthropic-version: 2023-06-01' \7436    -H "X-Api-Key: $ANTHROPIC_API_KEY"7437```74387439##### Response (200)74407441```json7442{7443  "data": [7444    {7445      "created_by_actor_id": "created_by_actor_id",7446      "implicit": true,7447      "service_account_id": "service_account_id",7448      "type": "service_account_workspace_member",7449      "workspace_id": "workspace_id",7450      "workspace_role": "workspace_admin"7451    }7452  ],7453  "next_page": "next_page"7454}7455```74567457### Remove Workspace From Service Account74587459**DELETE** `/v1/organizations/service_accounts/{service_account_id}/workspaces/{workspace_id}`74607461**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).74627463Remove a service account from a workspace.74647465Mirror of `DELETE /workspaces/{workspace_id}/service_accounts/{service_account_id}`,7466addressed from the service-account side. Removal is idempotent (returns7467200 even if the membership was already removed). A DELETE against the7468implicit default-workspace membership returns 200 but is a no-op and the7469membership persists; deleting an explicit default-workspace row reverts7470to the implicit `workspace_user` membership. Archived workspaces return7471400.74727473#### Path parameters74747475- `service_account_id: string`74767477  ID of the service account.74787479- `workspace_id: string`74807481  ID of the workspace.74827483#### Headers74847485- `"anthropic-beta": optional array of AnthropicBeta`74867487  Optional header to specify the beta version(s) you want to use.74887489  - `string`74907491  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`74927493    - `"message-batches-2024-09-24"`74947495    - `"prompt-caching-2024-07-31"`74967497    - `"computer-use-2024-10-22"`74987499    - `"computer-use-2025-01-24"`75007501    - `"pdfs-2024-09-25"`75027503    - `"token-counting-2024-11-01"`75047505    - `"token-efficient-tools-2025-02-19"`75067507    - `"output-128k-2025-02-19"`75087509    - `"files-api-2025-04-14"`75107511    - `"mcp-client-2025-04-04"`75127513    - `"mcp-client-2025-11-20"`75147515    - `"dev-full-thinking-2025-05-14"`75167517    - `"interleaved-thinking-2025-05-14"`75187519    - `"code-execution-2025-05-22"`75207521    - `"extended-cache-ttl-2025-04-11"`75227523    - `"context-1m-2025-08-07"`75247525    - `"context-management-2025-06-27"`75267527    - `"model-context-window-exceeded-2025-08-26"`75287529    - `"skills-2025-10-02"`75307531    - `"fast-mode-2026-02-01"`75327533    - `"output-300k-2026-03-24"`75347535    - `"user-profiles-2026-03-24"`75367537    - `"user-profiles-2026-08-18"`75387539    - `"user-profiles-2026-09-04"`75407541    - `"advisor-tool-2026-03-01"`75427543    - `"managed-agents-2026-04-01"`75447545    - `"cache-diagnosis-2026-04-07"`75467547    - `"dreaming-2026-04-21"`75487549    - `"thinking-token-count-2026-05-13"`75507551    - `"server-side-fallback-2026-06-01"`75527553    - `"server-side-fallback-2026-07-01"`75547555    - `"fallback-credit-2026-06-01"`75567557    - `"fallback-credit-2026-07-01"`75587559    - `"agent-memory-2026-07-22"`75607561    - `"mid-conversation-tool-changes-2026-07-01"`75627563    - `"compact-2026-01-12"`75647565    - `"computer-use-2025-11-24"`75667567    - `"mcp-tunnels-2026-06-22"`75687569    - `"structured-outputs-2025-11-13"`75707571    - `"task-budgets-2026-03-13"`75727573    - `"thinking-display-updates-2026-08-18"`75747575    - `"ce-user-management-2026-07-13"`75767577    - `"mid-conversation-output-config-2026-07-01"`75787579    - `"thinking-binding-controls-2026-08-01"`75807581    - `"mid-conversation-system-clear-at-2026-08-21"`75827583    - `"compact-2026-09-04"`75847585#### Returns75867587- `type: "service_account_workspace_member_deleted"`75887589  default: service_account_workspace_member_deleted75907591- `service_account_id: string`75927593  Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op.75947595- `workspace_id: string`75967597  Tagged workspace ID (`wrkspc_...`) named in the delete request.75987599#### Example76007601```bash7602curl https://api.anthropic.com/v1/organizations/service_accounts/$SERVICE_ACCOUNT_ID/workspaces/$WORKSPACE_ID \7603    -X DELETE \7604    -H 'anthropic-version: 2023-06-01' \7605    -H "X-Api-Key: $ANTHROPIC_API_KEY"7606```76077608##### Response (200)76097610```json7611{7612  "service_account_id": "service_account_id",7613  "type": "service_account_workspace_member_deleted",7614  "workspace_id": "workspace_id"7615}7616```76177618## Organization › Users76197620### List Users76217622**GET** `/v1/organizations/users`76237624List the organization's members.76257626#### Query parameters76277628- `after_id: optional string`76297630  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.76317632- `before_id: optional string`76337634  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.76357636- `email: optional string`76377638  Filter by user email.76397640  format: email76417642- `limit: optional number`76437644  Number of items to return per page.76457646  Defaults to `20`. Ranges from `1` to `1000`.76477648  default: 20, maximum: 1000, minimum: 176497650- `roles: optional array of string`76517652  Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together.76537654  Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`.76557656#### Returns76577658- `data: array of BetaOrganizationUser`76597660  - `type: "user"`76617662    Object type.76637664    For Users, this is always `"user"`.76657666    default: user76677668  - `id: string`76697670    ID of the User.76717672  - `added_at: string`76737674    RFC 3339 datetime string indicating when the User joined the Organization.76757676    format: date-time76777678  - `email: string`76797680    Email of the User.76817682  - `name: string`76837684    Name of the User.76857686  - `role: BetaOrganizationRole`76877688    Organization role of the User.76897690    - `"admin"`76917692    - `"billing"`76937694    - `"claude_code_user"`76957696    - `"developer"`76977698    - `"managed"`76997700    - `"membership_admin"`77017702    - `"owner"`77037704    - `"primary_owner"`77057706    - `"user"`77077708- `first_id: string or null`77097710  First ID in the `data` list. Can be used as the `before_id` for the previous page.77117712- `has_more: boolean`77137714  Indicates if there are more results in the requested page direction.77157716- `last_id: string or null`77177718  Last ID in the `data` list. Can be used as the `after_id` for the next page.77197720#### Example77217722```bash7723curl https://api.anthropic.com/v1/organizations/users \7724    -H 'anthropic-version: 2023-06-01' \7725    -H "X-Api-Key: $ANTHROPIC_API_KEY"7726```77277728##### Response (200)77297730```json7731{7732  "data": [7733    {7734      "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",7735      "added_at": "2024-10-30T23:58:27.427722Z",7736      "email": "user@emaildomain.com",7737      "name": "Jane Doe",7738      "role": "admin",7739      "type": "user"7740    }7741  ],7742  "first_id": "first_id",7743  "has_more": true,7744  "last_id": "last_id"7745}7746```77477748### Get User77497750**GET** `/v1/organizations/users/{user_id}`77517752Retrieve a member of the organization by user ID.77537754#### Path parameters77557756- `user_id: string`77577758  ID of the User.77597760#### Returns77617762- `BetaOrganizationUser object`77637764  - `type: "user"`77657766    Object type.77677768    For Users, this is always `"user"`.77697770    default: user77717772  - `id: string`77737774    ID of the User.77757776  - `added_at: string`77777778    RFC 3339 datetime string indicating when the User joined the Organization.77797780    format: date-time77817782  - `email: string`77837784    Email of the User.77857786  - `name: string`77877788    Name of the User.77897790  - `role: BetaOrganizationRole`77917792    Organization role of the User.77937794    - `"admin"`77957796    - `"billing"`77977798    - `"claude_code_user"`77997800    - `"developer"`78017802    - `"managed"`78037804    - `"membership_admin"`78057806    - `"owner"`78077808    - `"primary_owner"`78097810    - `"user"`78117812#### Example78137814```bash7815curl https://api.anthropic.com/v1/organizations/users/$USER_ID \7816    -H 'anthropic-version: 2023-06-01' \7817    -H "X-Api-Key: $ANTHROPIC_API_KEY"7818```78197820##### Response (200)78217822```json7823{7824  "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",7825  "added_at": "2024-10-30T23:58:27.427722Z",7826  "email": "user@emaildomain.com",7827  "name": "Jane Doe",7828  "role": "admin",7829  "type": "user"7830}7831```78327833### Update User78347835**POST** `/v1/organizations/users/{user_id}`78367837Update a member's organization role.78387839#### Path parameters78407841- `user_id: string`78427843  ID of the User.78447845#### Body parameters78467847- `role: "billing" or "claude_code_user" or "developer" or 2 more`78487849  New role for the User.78507851  The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations accept `user` and `managed`.78527853  - `"billing"`78547855  - `"claude_code_user"`78567857  - `"developer"`78587859  - `"managed"`78607861  - `"user"`78627863#### Returns78647865- `BetaOrganizationUser object`78667867  - `type: "user"`78687869    Object type.78707871    For Users, this is always `"user"`.78727873    default: user78747875  - `id: string`78767877    ID of the User.78787879  - `added_at: string`78807881    RFC 3339 datetime string indicating when the User joined the Organization.78827883    format: date-time78847885  - `email: string`78867887    Email of the User.78887889  - `name: string`78907891    Name of the User.78927893  - `role: BetaOrganizationRole`78947895    Organization role of the User.78967897    - `"admin"`78987899    - `"billing"`79007901    - `"claude_code_user"`79027903    - `"developer"`79047905    - `"managed"`79067907    - `"membership_admin"`79087909    - `"owner"`79107911    - `"primary_owner"`79127913    - `"user"`79147915#### Example79167917```bash7918curl https://api.anthropic.com/v1/organizations/users/$USER_ID \7919    -H 'Content-Type: application/json' \7920    -H 'anthropic-version: 2023-06-01' \7921    -H "X-Api-Key: $ANTHROPIC_API_KEY" \7922    -d '{7923          "role": "user"7924        }'7925```79267927##### Response (200)79287929```json7930{7931  "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",7932  "added_at": "2024-10-30T23:58:27.427722Z",7933  "email": "user@emaildomain.com",7934  "name": "Jane Doe",7935  "role": "admin",7936  "type": "user"7937}7938```79397940### Remove User79417942**DELETE** `/v1/organizations/users/{user_id}`79437944Remove a member from the organization.79457946#### Path parameters79477948- `user_id: string`79497950  ID of the User.79517952#### Returns79537954- `type: "user_deleted"`79557956  Deleted object type.79577958  For Users, this is always `"user_deleted"`.79597960  default: user_deleted79617962- `id: string`79637964  ID of the User.79657966#### Example79677968```bash7969curl https://api.anthropic.com/v1/organizations/users/$USER_ID \7970    -X DELETE \7971    -H 'anthropic-version: 2023-06-01' \7972    -H "X-Api-Key: $ANTHROPIC_API_KEY"7973```79747975##### Response (200)79767977```json7978{7979  "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",7980  "type": "user_deleted"7981}7982```79837984## Organization › Workspaces79857986### List Workspaces79877988**GET** `/v1/organizations/workspaces`79897990List Workspaces79917992#### Query parameters79937994- `after_id: optional string`79957996  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.79977998- `before_id: optional string`79998000  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.80018002- `include_archived: optional boolean`80038004  Whether to include Workspaces that have been archived in the response80058006  default: false80078008- `limit: optional number`80098010  Number of items to return per page.80118012  Defaults to `20`. Ranges from `1` to `1000`.80138014  default: 20, maximum: 1000, minimum: 180158016#### Returns80178018- `data: array of BetaWorkspace`80198020  - `type: "workspace"`80218022    Object type.80238024    For Workspaces, this is always `"workspace"`.80258026    default: workspace80278028  - `id: string`80298030    ID of the Workspace.80318032  - `archived_at: string or null`80338034    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.80358036    format: date-time80378038  - `compartment_id: string`80398040    Identifier for this Workspace's encryption compartment. When you configure a8041    customer-managed encryption key (CMEK) on AWS, reference this value in your8042    KMS key-policy condition so the key is scoped to this compartment. On GCP and8043    Azure, Anthropic enforces the compartment binding automatically; you do not8044    need to reference this value in your key configuration. See the CMEK8045    integration guide for the required key configuration; unless your organization8046    is on Claude Platform on AWS, it includes a separate value used during key8047    validation. On Claude Platform on AWS there is no separate validation value:8048    the key is validated against this Workspace's own value when it is attached, so8049    if your key policy uses the compartment condition, add this value to it before8050    attaching the key.80518052  - `created_at: string`80538054    RFC 3339 datetime string indicating when the Workspace was created.80558056    format: date-time80578058  - `data_residency: BetaDataResidency`80598060    Data residency configuration.80618062    - `allowed_inference_geos: array of BetaAllowedInferenceGeo or "unrestricted"`80638064      Permitted inference geo values. 'unrestricted' means all geos are allowed.80658066      - `Geos = array of BetaAllowedInferenceGeo`80678068        - `"global"`80698070        - `"us"`80718072      - `Unrestricted = "unrestricted"`80738074    - `default_inference_geo: "global" or "us"`80758076      Default inference geo applied when requests omit the parameter.80778078      - `"global"`80798080      - `"us"`80818082    - `workspace_geo: "us"`80838084      Geographic region for workspace data storage. Immutable after creation.80858086  - `display_color: string`80878088    Hex color code representing the Workspace in the Anthropic Console.80898090  - `external_key_id: string or null`80918092    ID of the customer-managed encryption key (CMEK) configuration to use for this8093    Workspace. Setting this field requires CMEK to be enabled for your8094    organization. When set, data stored for this Workspace is encrypted with the8095    referenced key. Create key configurations with the External Keys API. On8096    Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a8097    single-Region key in the same AWS account and Region as the Workspace. On that8098    platform the key is validated against this Workspace when it is attached, so a8099    key-policy problem is reported as an error on this request. This field is write-once:8100    once a key is attached to a Workspace it cannot be detached or replaced. To8101    rotate key material, rotate the underlying key on your cloud KMS; the8102    `external_key_id` stays the same.81038104  - `name: string`81058106    Name of the Workspace.81078108  - `tags: map[string]`81098110    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.81118112- `first_id: string or null`81138114  First ID in the `data` list. Can be used as the `before_id` for the previous page.81158116- `has_more: boolean`81178118  Indicates if there are more results in the requested page direction.81198120- `last_id: string or null`81218122  Last ID in the `data` list. Can be used as the `after_id` for the next page.81238124#### Example81258126```bash8127curl https://api.anthropic.com/v1/organizations/workspaces \8128    -H 'anthropic-version: 2023-06-01' \8129    -H "X-Api-Key: $ANTHROPIC_API_KEY"8130```81318132##### Response (200)81338134```json8135{8136  "data": [8137    {8138      "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",8139      "archived_at": "2024-11-01T23:59:27.427722Z",8140      "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",8141      "created_at": "2024-10-30T23:58:27.427722Z",8142      "data_residency": {8143        "allowed_inference_geos": "unrestricted",8144        "default_inference_geo": "global",8145        "workspace_geo": "us"8146      },8147      "display_color": "#6C5BB9",8148      "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",8149      "name": "Workspace Name",8150      "tags": {8151        "env": "prod",8152        "team": "platform"8153      },8154      "type": "workspace"8155    }8156  ],8157  "first_id": "first_id",8158  "has_more": true,8159  "last_id": "last_id"8160}8161```81628163### Create Workspace81648165**POST** `/v1/organizations/workspaces`81668167Create Workspace81688169#### Headers81708171- `"anthropic-beta": optional array of AnthropicBeta`81728173  Optional header to specify the beta version(s) you want to use.81748175  - `string`81768177  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`81788179    - `"message-batches-2024-09-24"`81808181    - `"prompt-caching-2024-07-31"`81828183    - `"computer-use-2024-10-22"`81848185    - `"computer-use-2025-01-24"`81868187    - `"pdfs-2024-09-25"`81888189    - `"token-counting-2024-11-01"`81908191    - `"token-efficient-tools-2025-02-19"`81928193    - `"output-128k-2025-02-19"`81948195    - `"files-api-2025-04-14"`81968197    - `"mcp-client-2025-04-04"`81988199    - `"mcp-client-2025-11-20"`82008201    - `"dev-full-thinking-2025-05-14"`82028203    - `"interleaved-thinking-2025-05-14"`82048205    - `"code-execution-2025-05-22"`82068207    - `"extended-cache-ttl-2025-04-11"`82088209    - `"context-1m-2025-08-07"`82108211    - `"context-management-2025-06-27"`82128213    - `"model-context-window-exceeded-2025-08-26"`82148215    - `"skills-2025-10-02"`82168217    - `"fast-mode-2026-02-01"`82188219    - `"output-300k-2026-03-24"`82208221    - `"user-profiles-2026-03-24"`82228223    - `"user-profiles-2026-08-18"`82248225    - `"user-profiles-2026-09-04"`82268227    - `"advisor-tool-2026-03-01"`82288229    - `"managed-agents-2026-04-01"`82308231    - `"cache-diagnosis-2026-04-07"`82328233    - `"dreaming-2026-04-21"`82348235    - `"thinking-token-count-2026-05-13"`82368237    - `"server-side-fallback-2026-06-01"`82388239    - `"server-side-fallback-2026-07-01"`82408241    - `"fallback-credit-2026-06-01"`82428243    - `"fallback-credit-2026-07-01"`82448245    - `"agent-memory-2026-07-22"`82468247    - `"mid-conversation-tool-changes-2026-07-01"`82488249    - `"compact-2026-01-12"`82508251    - `"computer-use-2025-11-24"`82528253    - `"mcp-tunnels-2026-06-22"`82548255    - `"structured-outputs-2025-11-13"`82568257    - `"task-budgets-2026-03-13"`82588259    - `"thinking-display-updates-2026-08-18"`82608261    - `"ce-user-management-2026-07-13"`82628263    - `"mid-conversation-output-config-2026-07-01"`82648265    - `"thinking-binding-controls-2026-08-01"`82668267    - `"mid-conversation-system-clear-at-2026-08-21"`82688269    - `"compact-2026-09-04"`82708271#### Body parameters82728273- `name: string`82748275  Name of the Workspace.82768277  maxLength: 40, minLength: 182788279- `data_residency: optional BetaDataResidencyCreateConfig or null`82808281  Data residency configuration for the workspace. If omitted, defaults to `workspace_geo: "us"`, `allowed_inference_geos: "unrestricted"`, and `default_inference_geo: "global"`.82828283  - `allowed_inference_geos: optional array of BetaAllowedInferenceGeo or "unrestricted" or null`82848285    Permitted inference geo values. Defaults to 'unrestricted' if omitted, which allows all geos. Use the string 'unrestricted' to allow all geos, or a list of specific geos.82868287    - `Geos = array of BetaAllowedInferenceGeo`82888289      - `"global"`82908291      - `"us"`82928293    - `Unrestricted = "unrestricted"`82948295  - `default_inference_geo: optional "global" or "us" or null`82968297    Default inference geo applied when requests omit the parameter. Defaults to 'global' if omitted. Must be a member of `allowed_inference_geos` unless `allowed_inference_geos` is `"unrestricted"`.82988299    - `"global"`83008301    - `"us"`83028303  - `workspace_geo: optional "us" or null`83048305    Geographic region for workspace data storage. Immutable after creation. Defaults to 'us' if omitted.83068307- `display_color: optional string or null`83088309  Hex color code representing the Workspace in the Anthropic Console.83108311  maxLength: 7, pattern: ^#[0-9A-Fa-f]{6}$83128313- `external_key_id: optional string or null`83148315  ID of the customer-managed encryption key (CMEK) configuration to use for this8316  Workspace. Setting this field requires CMEK to be enabled for your8317  organization. When set, data stored for this Workspace is encrypted with the8318  referenced key. Create key configurations with the External Keys API. On8319  Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a8320  single-Region key in the same AWS account and Region as the Workspace. On that8321  platform the key is validated against this Workspace when it is attached, so a8322  key-policy problem is reported as an error on this request. This field is write-once:8323  once a key is attached to a Workspace it cannot be detached or replaced. To8324  rotate key material, rotate the underlying key on your cloud KMS; the8325  `external_key_id` stays the same.83268327- `tags: optional map[string] or null`83288329  User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.83308331#### Returns83328333- `BetaWorkspace object`83348335  - `type: "workspace"`83368337    Object type.83388339    For Workspaces, this is always `"workspace"`.83408341    default: workspace83428343  - `id: string`83448345    ID of the Workspace.83468347  - `archived_at: string or null`83488349    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.83508351    format: date-time83528353  - `compartment_id: string`83548355    Identifier for this Workspace's encryption compartment. When you configure a8356    customer-managed encryption key (CMEK) on AWS, reference this value in your8357    KMS key-policy condition so the key is scoped to this compartment. On GCP and8358    Azure, Anthropic enforces the compartment binding automatically; you do not8359    need to reference this value in your key configuration. See the CMEK8360    integration guide for the required key configuration; unless your organization8361    is on Claude Platform on AWS, it includes a separate value used during key8362    validation. On Claude Platform on AWS there is no separate validation value:8363    the key is validated against this Workspace's own value when it is attached, so8364    if your key policy uses the compartment condition, add this value to it before8365    attaching the key.83668367  - `created_at: string`83688369    RFC 3339 datetime string indicating when the Workspace was created.83708371    format: date-time83728373  - `data_residency: BetaDataResidency`83748375    Data residency configuration.83768377    - `allowed_inference_geos: array of BetaAllowedInferenceGeo or "unrestricted"`83788379      Permitted inference geo values. 'unrestricted' means all geos are allowed.83808381      - `Geos = array of BetaAllowedInferenceGeo`83828383        - `"global"`83848385        - `"us"`83868387      - `Unrestricted = "unrestricted"`83888389    - `default_inference_geo: "global" or "us"`83908391      Default inference geo applied when requests omit the parameter.83928393      - `"global"`83948395      - `"us"`83968397    - `workspace_geo: "us"`83988399      Geographic region for workspace data storage. Immutable after creation.84008401  - `display_color: string`84028403    Hex color code representing the Workspace in the Anthropic Console.84048405  - `external_key_id: string or null`84068407    ID of the customer-managed encryption key (CMEK) configuration to use for this8408    Workspace. Setting this field requires CMEK to be enabled for your8409    organization. When set, data stored for this Workspace is encrypted with the8410    referenced key. Create key configurations with the External Keys API. On8411    Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a8412    single-Region key in the same AWS account and Region as the Workspace. On that8413    platform the key is validated against this Workspace when it is attached, so a8414    key-policy problem is reported as an error on this request. This field is write-once:8415    once a key is attached to a Workspace it cannot be detached or replaced. To8416    rotate key material, rotate the underlying key on your cloud KMS; the8417    `external_key_id` stays the same.84188419  - `name: string`84208421    Name of the Workspace.84228423  - `tags: map[string]`84248425    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.84268427#### Example84288429```bash8430curl https://api.anthropic.com/v1/organizations/workspaces \8431    -H 'Content-Type: application/json' \8432    -H 'anthropic-version: 2023-06-01' \8433    -H "X-Api-Key: $ANTHROPIC_API_KEY" \8434    -d '{8435          "name": "x",8436          "display_color": "#6C5BB9",8437          "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",8438          "tags": {8439            "env": "prod",8440            "team": "platform"8441          }8442        }'8443```84448445##### Response (200)84468447```json8448{8449  "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",8450  "archived_at": "2024-11-01T23:59:27.427722Z",8451  "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",8452  "created_at": "2024-10-30T23:58:27.427722Z",8453  "data_residency": {8454    "allowed_inference_geos": "unrestricted",8455    "default_inference_geo": "global",8456    "workspace_geo": "us"8457  },8458  "display_color": "#6C5BB9",8459  "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",8460  "name": "Workspace Name",8461  "tags": {8462    "env": "prod",8463    "team": "platform"8464  },8465  "type": "workspace"8466}8467```84688469### Get Workspace84708471**GET** `/v1/organizations/workspaces/{workspace_id}`84728473Get Workspace84748475#### Path parameters84768477- `workspace_id: string`84788479  ID of the Workspace.84808481#### Returns84828483- `BetaWorkspace object`84848485  - `type: "workspace"`84868487    Object type.84888489    For Workspaces, this is always `"workspace"`.84908491    default: workspace84928493  - `id: string`84948495    ID of the Workspace.84968497  - `archived_at: string or null`84988499    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.85008501    format: date-time85028503  - `compartment_id: string`85048505    Identifier for this Workspace's encryption compartment. When you configure a8506    customer-managed encryption key (CMEK) on AWS, reference this value in your8507    KMS key-policy condition so the key is scoped to this compartment. On GCP and8508    Azure, Anthropic enforces the compartment binding automatically; you do not8509    need to reference this value in your key configuration. See the CMEK8510    integration guide for the required key configuration; unless your organization8511    is on Claude Platform on AWS, it includes a separate value used during key8512    validation. On Claude Platform on AWS there is no separate validation value:8513    the key is validated against this Workspace's own value when it is attached, so8514    if your key policy uses the compartment condition, add this value to it before8515    attaching the key.85168517  - `created_at: string`85188519    RFC 3339 datetime string indicating when the Workspace was created.85208521    format: date-time85228523  - `data_residency: BetaDataResidency`85248525    Data residency configuration.85268527    - `allowed_inference_geos: array of BetaAllowedInferenceGeo or "unrestricted"`85288529      Permitted inference geo values. 'unrestricted' means all geos are allowed.85308531      - `Geos = array of BetaAllowedInferenceGeo`85328533        - `"global"`85348535        - `"us"`85368537      - `Unrestricted = "unrestricted"`85388539    - `default_inference_geo: "global" or "us"`85408541      Default inference geo applied when requests omit the parameter.85428543      - `"global"`85448545      - `"us"`85468547    - `workspace_geo: "us"`85488549      Geographic region for workspace data storage. Immutable after creation.85508551  - `display_color: string`85528553    Hex color code representing the Workspace in the Anthropic Console.85548555  - `external_key_id: string or null`85568557    ID of the customer-managed encryption key (CMEK) configuration to use for this8558    Workspace. Setting this field requires CMEK to be enabled for your8559    organization. When set, data stored for this Workspace is encrypted with the8560    referenced key. Create key configurations with the External Keys API. On8561    Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a8562    single-Region key in the same AWS account and Region as the Workspace. On that8563    platform the key is validated against this Workspace when it is attached, so a8564    key-policy problem is reported as an error on this request. This field is write-once:8565    once a key is attached to a Workspace it cannot be detached or replaced. To8566    rotate key material, rotate the underlying key on your cloud KMS; the8567    `external_key_id` stays the same.85688569  - `name: string`85708571    Name of the Workspace.85728573  - `tags: map[string]`85748575    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.85768577#### Example85788579```bash8580curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID \8581    -H 'anthropic-version: 2023-06-01' \8582    -H "X-Api-Key: $ANTHROPIC_API_KEY"8583```85848585##### Response (200)85868587```json8588{8589  "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",8590  "archived_at": "2024-11-01T23:59:27.427722Z",8591  "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",8592  "created_at": "2024-10-30T23:58:27.427722Z",8593  "data_residency": {8594    "allowed_inference_geos": "unrestricted",8595    "default_inference_geo": "global",8596    "workspace_geo": "us"8597  },8598  "display_color": "#6C5BB9",8599  "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",8600  "name": "Workspace Name",8601  "tags": {8602    "env": "prod",8603    "team": "platform"8604  },8605  "type": "workspace"8606}8607```86088609### Update Workspace86108611**POST** `/v1/organizations/workspaces/{workspace_id}`86128613Update Workspace86148615#### Path parameters86168617- `workspace_id: string`86188619#### Body parameters86208621- `data_residency: optional BetaDataResidencyUpdateConfig or null`86228623  Data residency configuration for the workspace.86248625  - `allowed_inference_geos: optional array of BetaAllowedInferenceGeo or "unrestricted" or null`86268627    Permitted inference geo values. Use 'unrestricted' to allow all geos, or a list of specific geos.86288629    - `Geos = array of BetaAllowedInferenceGeo`86308631      - `"global"`86328633      - `"us"`86348635    - `Unrestricted = "unrestricted"`86368637  - `default_inference_geo: optional "global" or "us" or null`86388639    Default inference geo applied when requests omit the parameter. Must be a member of `allowed_inference_geos` unless `allowed_inference_geos` is `"unrestricted"`.86408641    - `"global"`86428643    - `"us"`86448645- `display_color: optional string`86468647  Hex color code representing the Workspace in the Anthropic Console.86488649  maxLength: 7, pattern: ^#[0-9A-Fa-f]{6}$86508651- `external_key_id: optional string`86528653  ID of the customer-managed encryption key (CMEK) configuration to use for this8654  Workspace. Setting this field requires CMEK to be enabled for your8655  organization. When set, data stored for this Workspace is encrypted with the8656  referenced key. Create key configurations with the External Keys API. On8657  Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a8658  single-Region key in the same AWS account and Region as the Workspace. On that8659  platform the key is validated against this Workspace when it is attached, so a8660  key-policy problem is reported as an error on this request. This field is write-once:8661  once a key is attached to a Workspace it cannot be detached or replaced. To8662  rotate key material, rotate the underlying key on your cloud KMS; the8663  `external_key_id` stays the same.86648665- `name: optional string`86668667  Name of the Workspace.86688669  maxLength: 40, minLength: 186708671- `tags: optional map[string] or null`86728673  User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.86748675#### Returns86768677- `BetaWorkspace object`86788679  - `type: "workspace"`86808681    Object type.86828683    For Workspaces, this is always `"workspace"`.86848685    default: workspace86868687  - `id: string`86888689    ID of the Workspace.86908691  - `archived_at: string or null`86928693    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.86948695    format: date-time86968697  - `compartment_id: string`86988699    Identifier for this Workspace's encryption compartment. When you configure a8700    customer-managed encryption key (CMEK) on AWS, reference this value in your8701    KMS key-policy condition so the key is scoped to this compartment. On GCP and8702    Azure, Anthropic enforces the compartment binding automatically; you do not8703    need to reference this value in your key configuration. See the CMEK8704    integration guide for the required key configuration; unless your organization8705    is on Claude Platform on AWS, it includes a separate value used during key8706    validation. On Claude Platform on AWS there is no separate validation value:8707    the key is validated against this Workspace's own value when it is attached, so8708    if your key policy uses the compartment condition, add this value to it before8709    attaching the key.87108711  - `created_at: string`87128713    RFC 3339 datetime string indicating when the Workspace was created.87148715    format: date-time87168717  - `data_residency: BetaDataResidency`87188719    Data residency configuration.87208721    - `allowed_inference_geos: array of BetaAllowedInferenceGeo or "unrestricted"`87228723      Permitted inference geo values. 'unrestricted' means all geos are allowed.87248725      - `Geos = array of BetaAllowedInferenceGeo`87268727        - `"global"`87288729        - `"us"`87308731      - `Unrestricted = "unrestricted"`87328733    - `default_inference_geo: "global" or "us"`87348735      Default inference geo applied when requests omit the parameter.87368737      - `"global"`87388739      - `"us"`87408741    - `workspace_geo: "us"`87428743      Geographic region for workspace data storage. Immutable after creation.87448745  - `display_color: string`87468747    Hex color code representing the Workspace in the Anthropic Console.87488749  - `external_key_id: string or null`87508751    ID of the customer-managed encryption key (CMEK) configuration to use for this8752    Workspace. Setting this field requires CMEK to be enabled for your8753    organization. When set, data stored for this Workspace is encrypted with the8754    referenced key. Create key configurations with the External Keys API. On8755    Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a8756    single-Region key in the same AWS account and Region as the Workspace. On that8757    platform the key is validated against this Workspace when it is attached, so a8758    key-policy problem is reported as an error on this request. This field is write-once:8759    once a key is attached to a Workspace it cannot be detached or replaced. To8760    rotate key material, rotate the underlying key on your cloud KMS; the8761    `external_key_id` stays the same.87628763  - `name: string`87648765    Name of the Workspace.87668767  - `tags: map[string]`87688769    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.87708771#### Example87728773```bash8774curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID \8775    -H 'Content-Type: application/json' \8776    -H 'anthropic-version: 2023-06-01' \8777    -H "X-Api-Key: $ANTHROPIC_API_KEY" \8778    -d '{8779          "display_color": "#6C5BB9",8780          "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",8781          "tags": {8782            "env": "prod",8783            "team": "platform"8784          }8785        }'8786```87878788##### Response (200)87898790```json8791{8792  "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",8793  "archived_at": "2024-11-01T23:59:27.427722Z",8794  "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",8795  "created_at": "2024-10-30T23:58:27.427722Z",8796  "data_residency": {8797    "allowed_inference_geos": "unrestricted",8798    "default_inference_geo": "global",8799    "workspace_geo": "us"8800  },8801  "display_color": "#6C5BB9",8802  "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",8803  "name": "Workspace Name",8804  "tags": {8805    "env": "prod",8806    "team": "platform"8807  },8808  "type": "workspace"8809}8810```88118812### Archive Workspace88138814**POST** `/v1/organizations/workspaces/{workspace_id}/archive`88158816Archive Workspace88178818#### Path parameters88198820- `workspace_id: string`88218822#### Returns88238824- `BetaWorkspace object`88258826  - `type: "workspace"`88278828    Object type.88298830    For Workspaces, this is always `"workspace"`.88318832    default: workspace88338834  - `id: string`88358836    ID of the Workspace.88378838  - `archived_at: string or null`88398840    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.88418842    format: date-time88438844  - `compartment_id: string`88458846    Identifier for this Workspace's encryption compartment. When you configure a8847    customer-managed encryption key (CMEK) on AWS, reference this value in your8848    KMS key-policy condition so the key is scoped to this compartment. On GCP and8849    Azure, Anthropic enforces the compartment binding automatically; you do not8850    need to reference this value in your key configuration. See the CMEK8851    integration guide for the required key configuration; unless your organization8852    is on Claude Platform on AWS, it includes a separate value used during key8853    validation. On Claude Platform on AWS there is no separate validation value:8854    the key is validated against this Workspace's own value when it is attached, so8855    if your key policy uses the compartment condition, add this value to it before8856    attaching the key.88578858  - `created_at: string`88598860    RFC 3339 datetime string indicating when the Workspace was created.88618862    format: date-time88638864  - `data_residency: BetaDataResidency`88658866    Data residency configuration.88678868    - `allowed_inference_geos: array of BetaAllowedInferenceGeo or "unrestricted"`88698870      Permitted inference geo values. 'unrestricted' means all geos are allowed.88718872      - `Geos = array of BetaAllowedInferenceGeo`88738874        - `"global"`88758876        - `"us"`88778878      - `Unrestricted = "unrestricted"`88798880    - `default_inference_geo: "global" or "us"`88818882      Default inference geo applied when requests omit the parameter.88838884      - `"global"`88858886      - `"us"`88878888    - `workspace_geo: "us"`88898890      Geographic region for workspace data storage. Immutable after creation.88918892  - `display_color: string`88938894    Hex color code representing the Workspace in the Anthropic Console.88958896  - `external_key_id: string or null`88978898    ID of the customer-managed encryption key (CMEK) configuration to use for this8899    Workspace. Setting this field requires CMEK to be enabled for your8900    organization. When set, data stored for this Workspace is encrypted with the8901    referenced key. Create key configurations with the External Keys API. On8902    Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a8903    single-Region key in the same AWS account and Region as the Workspace. On that8904    platform the key is validated against this Workspace when it is attached, so a8905    key-policy problem is reported as an error on this request. This field is write-once:8906    once a key is attached to a Workspace it cannot be detached or replaced. To8907    rotate key material, rotate the underlying key on your cloud KMS; the8908    `external_key_id` stays the same.89098910  - `name: string`89118912    Name of the Workspace.89138914  - `tags: map[string]`89158916    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.89178918#### Example89198920```bash8921curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/archive \8922    -X POST \8923    -H 'anthropic-version: 2023-06-01' \8924    -H "X-Api-Key: $ANTHROPIC_API_KEY"8925```89268927##### Response (200)89288929```json8930{8931  "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",8932  "archived_at": "2024-11-01T23:59:27.427722Z",8933  "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",8934  "created_at": "2024-10-30T23:58:27.427722Z",8935  "data_residency": {8936    "allowed_inference_geos": "unrestricted",8937    "default_inference_geo": "global",8938    "workspace_geo": "us"8939  },8940  "display_color": "#6C5BB9",8941  "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",8942  "name": "Workspace Name",8943  "tags": {8944    "env": "prod",8945    "team": "platform"8946  },8947  "type": "workspace"8948}8949```89508951## Organization › Workspaces › Rate Limits89528953### List Workspace Rate Limits89548955**GET** `/v1/organizations/workspaces/{workspace_id}/rate_limits`89568957List rate-limit overrides configured for a workspace.89588959Returns only the groups and limiter types that have a workspace-level8960override. Groups without overrides inherit the organization limits and8961are not listed; use `GET /v1/organizations/rate_limits` to see those.89628963When `limit` is omitted, every matching entry is returned in a single8964page; when `limit` truncates the result, follow `next_page` to fetch8965the remaining entries.89668967#### Path parameters89688969- `workspace_id: string`89708971  The ID of the workspace.89728973#### Query parameters89748975- `group_type: optional "batch" or "files" or "model_group" or 3 more`89768977  Filter by group type.89788979  - `"batch"`89808981  - `"files"`89828983  - `"model_group"`89848985  - `"skills"`89868987  - `"token_count"`89888989  - `"web_search"`89908991- `limit: optional number`89928993  Maximum number of items to return per page. Ranges from `1` to `1000`.89948995  When omitted, every remaining entry is returned in a single page and `next_page` is `null`.89968997  maximum: 1000, minimum: 189988999- `page: optional string`90009001  Opaque cursor from a previous response's `next_page`.90029003#### Returns90049005- `data: array of BetaWorkspaceRateLimit`90069007  Rate-limit entries for the workspace, one per group that has at least one override.90089009  - `type: "workspace_rate_limit"`90109011    Object type. Always `workspace_rate_limit` for workspace rate-limit entries.90129013    default: workspace_rate_limit90149015  - `group_type: "batch" or "files" or "model_group" or 3 more`90169017    The kind of rate-limit group this entry represents. `model_group` entries apply to a family of models (listed in `models`); other values apply to an API-surface category and have `models` set to `null`.90189019    - `"batch"`90209021    - `"files"`90229023    - `"model_group"`90249025    - `"skills"`90269027    - `"token_count"`90289029    - `"web_search"`90309031  - `limits: array of BetaWorkspaceRateLimitValue`90329033    The limiter values overridden for this group in this workspace. Limiter types without a workspace override are omitted and inherit the organization value.90349035    - `type: string`90369037      The limiter type (for example, `requests_per_minute` or `input_tokens_per_minute`).90389039    - `org_limit: number or null`90409041      The organization-level value for the same limiter type, for reference. `null` when the organization has no limit configured for this limiter type.90429043    - `value: number`90449045      The workspace-level override value for this limiter type.90469047  - `models: array of string or null`90489049    Model names this entry's limits apply to, including aliases. `null` when `group_type` is not `"model_group"`.90509051  - `rate_limit_id: string`90529053    The `id` of the RateLimit group this override applies to.90549055  - `workspace_id: string`90569057    ID of the Workspace this override applies to.90589059- `next_page: string or null`90609061  Opaque cursor for the next page of results, or `null` when no entries remain beyond this response.90629063#### Example90649065```bash9066curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/rate_limits \9067    -H 'anthropic-version: 2023-06-01' \9068    -H "X-Api-Key: $ANTHROPIC_API_KEY"9069```90709071##### Response (200)90729073```json9074{9075  "data": [9076    {9077      "group_type": "batch",9078      "limits": [9079        {9080          "org_limit": 0,9081          "type": "type",9082          "value": 09083        }9084      ],9085      "models": [9086        "string"9087      ],9088      "rate_limit_id": "rate_limit_id",9089      "type": "workspace_rate_limit",9090      "workspace_id": "workspace_id"9091    }9092  ],9093  "next_page": "next_page"9094}9095```90969097## Organization › Workspaces › Members90989099### List Workspace Members91009101**GET** `/v1/organizations/workspaces/{workspace_id}/members`91029103List Workspace Members91049105#### Path parameters91069107- `workspace_id: string`91089109  ID of the Workspace.91109111#### Query parameters91129113- `after_id: optional string`91149115  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.91169117- `before_id: optional string`91189119  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.91209121- `limit: optional number`91229123  Number of items to return per page.91249125  Defaults to `20`. Ranges from `1` to `1000`.91269127  default: 20, maximum: 1000, minimum: 191289129#### Returns91309131- `data: array of BetaWorkspaceMember`91329133  - `type: "workspace_member"`91349135    Object type.91369137    For Workspace Members, this is always `"workspace_member"`.91389139    default: workspace_member91409141  - `user_id: string`91429143    ID of the User.91449145  - `workspace_id: string`91469147    ID of the Workspace.91489149  - `workspace_role: BetaWorkspaceRole`91509151    Role of the Workspace Member.91529153    - `"workspace_admin"`91549155    - `"workspace_billing"`91569157    - `"workspace_developer"`91589159    - `"workspace_restricted_developer"`91609161    - `"workspace_user"`91629163- `first_id: string or null`91649165  First ID in the `data` list. Can be used as the `before_id` for the previous page.91669167- `has_more: boolean`91689169  Indicates if there are more results in the requested page direction.91709171- `last_id: string or null`91729173  Last ID in the `data` list. Can be used as the `after_id` for the next page.91749175#### Example91769177```bash9178curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members \9179    -H 'anthropic-version: 2023-06-01' \9180    -H "X-Api-Key: $ANTHROPIC_API_KEY"9181```91829183##### Response (200)91849185```json9186{9187  "data": [9188    {9189      "type": "workspace_member",9190      "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",9191      "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",9192      "workspace_role": "workspace_admin"9193    }9194  ],9195  "first_id": "first_id",9196  "has_more": true,9197  "last_id": "last_id"9198}9199```92009201### Create Workspace Member92029203**POST** `/v1/organizations/workspaces/{workspace_id}/members`92049205Create Workspace Member92069207#### Path parameters92089209- `workspace_id: string`92109211  ID of the Workspace.92129213#### Body parameters92149215- `user_id: string`92169217  ID of the User.92189219- `workspace_role: BetaNoBillingWorkspaceRole`92209221  Role of the new Workspace Member. Cannot be `workspace_billing`.92229223  - `"workspace_admin"`92249225  - `"workspace_developer"`92269227  - `"workspace_restricted_developer"`92289229  - `"workspace_user"`92309231#### Returns92329233- `BetaWorkspaceMember object`92349235  - `type: "workspace_member"`92369237    Object type.92389239    For Workspace Members, this is always `"workspace_member"`.92409241    default: workspace_member92429243  - `user_id: string`92449245    ID of the User.92469247  - `workspace_id: string`92489249    ID of the Workspace.92509251  - `workspace_role: BetaWorkspaceRole`92529253    Role of the Workspace Member.92549255    - `"workspace_admin"`92569257    - `"workspace_billing"`92589259    - `"workspace_developer"`92609261    - `"workspace_restricted_developer"`92629263    - `"workspace_user"`92649265#### Example92669267```bash9268curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members \9269    -H 'Content-Type: application/json' \9270    -H 'anthropic-version: 2023-06-01' \9271    -H "X-Api-Key: $ANTHROPIC_API_KEY" \9272    -d '{9273          "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",9274          "workspace_role": "workspace_admin"9275        }'9276```92779278##### Response (200)92799280```json9281{9282  "type": "workspace_member",9283  "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",9284  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",9285  "workspace_role": "workspace_admin"9286}9287```92889289### Get Workspace Member92909291**GET** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}`92929293Get Workspace Member92949295#### Path parameters92969297- `workspace_id: string`92989299  ID of the Workspace.93009301- `user_id: string`93029303  ID of the User.93049305#### Returns93069307- `BetaWorkspaceMember object`93089309  - `type: "workspace_member"`93109311    Object type.93129313    For Workspace Members, this is always `"workspace_member"`.93149315    default: workspace_member93169317  - `user_id: string`93189319    ID of the User.93209321  - `workspace_id: string`93229323    ID of the Workspace.93249325  - `workspace_role: BetaWorkspaceRole`93269327    Role of the Workspace Member.93289329    - `"workspace_admin"`93309331    - `"workspace_billing"`93329333    - `"workspace_developer"`93349335    - `"workspace_restricted_developer"`93369337    - `"workspace_user"`93389339#### Example93409341```bash9342curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members/$USER_ID \9343    -H 'anthropic-version: 2023-06-01' \9344    -H "X-Api-Key: $ANTHROPIC_API_KEY"9345```93469347##### Response (200)93489349```json9350{9351  "type": "workspace_member",9352  "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",9353  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",9354  "workspace_role": "workspace_admin"9355}9356```93579358### Update Workspace Member93599360**POST** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}`93619362Update Workspace Member93639364#### Path parameters93659366- `workspace_id: string`93679368  ID of the Workspace.93699370- `user_id: string`93719372  ID of the User.93739374#### Body parameters93759376- `workspace_role: BetaWorkspaceRole`93779378  New workspace role for the User.93799380  - `"workspace_admin"`93819382  - `"workspace_billing"`93839384  - `"workspace_developer"`93859386  - `"workspace_restricted_developer"`93879388  - `"workspace_user"`93899390#### Returns93919392- `BetaWorkspaceMember object`93939394  - `type: "workspace_member"`93959396    Object type.93979398    For Workspace Members, this is always `"workspace_member"`.93999400    default: workspace_member94019402  - `user_id: string`94039404    ID of the User.94059406  - `workspace_id: string`94079408    ID of the Workspace.94099410  - `workspace_role: BetaWorkspaceRole`94119412    Role of the Workspace Member.94139414    - `"workspace_admin"`94159416    - `"workspace_billing"`94179418    - `"workspace_developer"`94199420    - `"workspace_restricted_developer"`94219422    - `"workspace_user"`94239424#### Example94259426```bash9427curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members/$USER_ID \9428    -H 'Content-Type: application/json' \9429    -H 'anthropic-version: 2023-06-01' \9430    -H "X-Api-Key: $ANTHROPIC_API_KEY" \9431    -d '{9432          "workspace_role": "workspace_admin"9433        }'9434```94359436##### Response (200)94379438```json9439{9440  "type": "workspace_member",9441  "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",9442  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",9443  "workspace_role": "workspace_admin"9444}9445```94469447### Delete Workspace Member94489449**DELETE** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}`94509451Delete Workspace Member94529453#### Path parameters94549455- `workspace_id: string`94569457  ID of the Workspace.94589459- `user_id: string`94609461  ID of the User.94629463#### Returns94649465- `type: "workspace_member_deleted"`94669467  Deleted object type.94689469  For Workspace Members, this is always `"workspace_member_deleted"`.94709471  default: workspace_member_deleted94729473- `user_id: string`94749475  ID of the User.94769477- `workspace_id: string`94789479  ID of the Workspace.94809481#### Example94829483```bash9484curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/members/$USER_ID \9485    -X DELETE \9486    -H 'anthropic-version: 2023-06-01' \9487    -H "X-Api-Key: $ANTHROPIC_API_KEY"9488```94899490##### Response (200)94919492```json9493{9494  "type": "workspace_member_deleted",9495  "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",9496  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"9497}9498```94999500## Organization › Workspaces › Service Accounts95019502### List Service Account Workspace Members95039504**GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts`95059506**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).95079508List the service accounts that are members of a workspace.95099510Each entry includes the service account's `workspace_role`. Use `limit`9511and the `next_page` cursor to paginate. Archived workspaces return 400;9512use `GET /service_accounts/{id}/workspaces` to audit memberships of an9513archived workspace. The implicit default-workspace membership is not9514included in this list. Memberships of archived service accounts are9515omitted from the results.95169517#### Path parameters95189519- `workspace_id: string`95209521  ID of the workspace.95229523#### Query parameters95249525- `limit: optional number`95269527  Number of results per page.95289529  default: 20, maximum: 100, minimum: 195309531- `page: optional string`95329533  Opaque cursor from a previous response's `next_page`.95349535#### Headers95369537- `"anthropic-beta": optional array of AnthropicBeta`95389539  Optional header to specify the beta version(s) you want to use.95409541  - `string`95429543  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`95449545    - `"message-batches-2024-09-24"`95469547    - `"prompt-caching-2024-07-31"`95489549    - `"computer-use-2024-10-22"`95509551    - `"computer-use-2025-01-24"`95529553    - `"pdfs-2024-09-25"`95549555    - `"token-counting-2024-11-01"`95569557    - `"token-efficient-tools-2025-02-19"`95589559    - `"output-128k-2025-02-19"`95609561    - `"files-api-2025-04-14"`95629563    - `"mcp-client-2025-04-04"`95649565    - `"mcp-client-2025-11-20"`95669567    - `"dev-full-thinking-2025-05-14"`95689569    - `"interleaved-thinking-2025-05-14"`95709571    - `"code-execution-2025-05-22"`95729573    - `"extended-cache-ttl-2025-04-11"`95749575    - `"context-1m-2025-08-07"`95769577    - `"context-management-2025-06-27"`95789579    - `"model-context-window-exceeded-2025-08-26"`95809581    - `"skills-2025-10-02"`95829583    - `"fast-mode-2026-02-01"`95849585    - `"output-300k-2026-03-24"`95869587    - `"user-profiles-2026-03-24"`95889589    - `"user-profiles-2026-08-18"`95909591    - `"user-profiles-2026-09-04"`95929593    - `"advisor-tool-2026-03-01"`95949595    - `"managed-agents-2026-04-01"`95969597    - `"cache-diagnosis-2026-04-07"`95989599    - `"dreaming-2026-04-21"`96009601    - `"thinking-token-count-2026-05-13"`96029603    - `"server-side-fallback-2026-06-01"`96049605    - `"server-side-fallback-2026-07-01"`96069607    - `"fallback-credit-2026-06-01"`96089609    - `"fallback-credit-2026-07-01"`96109611    - `"agent-memory-2026-07-22"`96129613    - `"mid-conversation-tool-changes-2026-07-01"`96149615    - `"compact-2026-01-12"`96169617    - `"computer-use-2025-11-24"`96189619    - `"mcp-tunnels-2026-06-22"`96209621    - `"structured-outputs-2025-11-13"`96229623    - `"task-budgets-2026-03-13"`96249625    - `"thinking-display-updates-2026-08-18"`96269627    - `"ce-user-management-2026-07-13"`96289629    - `"mid-conversation-output-config-2026-07-01"`96309631    - `"thinking-binding-controls-2026-08-01"`96329633    - `"mid-conversation-system-clear-at-2026-08-21"`96349635    - `"compact-2026-09-04"`96369637#### Returns96389639- `data: array of BetaServiceAccountWorkspaceMember`96409641  - `type: "service_account_workspace_member"`96429643    default: service_account_workspace_member96449645  - `created_by_actor_id: string or null`96469647    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.96489649  - `implicit: boolean or null`96509651    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.96529653  - `service_account_id: string`96549655    Tagged service account ID (`svac_...`).96569657  - `workspace_id: string`96589659    Tagged workspace ID (`wrkspc_...`).96609661  - `workspace_role: BetaWorkspaceRole`96629663    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.96649665    - `"workspace_admin"`96669667    - `"workspace_billing"`96689669    - `"workspace_developer"`96709671    - `"workspace_restricted_developer"`96729673    - `"workspace_user"`96749675- `next_page: string or null`96769677  Opaque cursor for the next page, or null if no more results.96789679#### Example96809681```bash9682curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts \9683    -H 'anthropic-version: 2023-06-01' \9684    -H "X-Api-Key: $ANTHROPIC_API_KEY"9685```96869687##### Response (200)96889689```json9690{9691  "data": [9692    {9693      "created_by_actor_id": "created_by_actor_id",9694      "implicit": true,9695      "service_account_id": "service_account_id",9696      "type": "service_account_workspace_member",9697      "workspace_id": "workspace_id",9698      "workspace_role": "workspace_admin"9699    }9700  ],9701  "next_page": "next_page"9702}9703```97049705### Create Service Account Workspace Member97069707**POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts`97089709**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).97109711Add a service account to a workspace with the given `workspace_role`.97129713The role determines what the service account can do in the workspace and9714which workspace-scoped permissions it can be granted when authenticating9715through federation. Every service account is already an implicit9716`workspace_user` member of the default workspace; adding it explicitly9717assigns a chosen role. If the service account is already an explicit9718member of the workspace, its `workspace_role` is replaced with the9719value supplied here. Archived workspaces return 400. Archived service9720accounts cannot be added and are rejected.97219722#### Path parameters97239724- `workspace_id: string`97259726  ID of the workspace.97279728#### Headers97299730- `"anthropic-beta": optional array of AnthropicBeta`97319732  Optional header to specify the beta version(s) you want to use.97339734  - `string`97359736  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`97379738    - `"message-batches-2024-09-24"`97399740    - `"prompt-caching-2024-07-31"`97419742    - `"computer-use-2024-10-22"`97439744    - `"computer-use-2025-01-24"`97459746    - `"pdfs-2024-09-25"`97479748    - `"token-counting-2024-11-01"`97499750    - `"token-efficient-tools-2025-02-19"`97519752    - `"output-128k-2025-02-19"`97539754    - `"files-api-2025-04-14"`97559756    - `"mcp-client-2025-04-04"`97579758    - `"mcp-client-2025-11-20"`97599760    - `"dev-full-thinking-2025-05-14"`97619762    - `"interleaved-thinking-2025-05-14"`97639764    - `"code-execution-2025-05-22"`97659766    - `"extended-cache-ttl-2025-04-11"`97679768    - `"context-1m-2025-08-07"`97699770    - `"context-management-2025-06-27"`97719772    - `"model-context-window-exceeded-2025-08-26"`97739774    - `"skills-2025-10-02"`97759776    - `"fast-mode-2026-02-01"`97779778    - `"output-300k-2026-03-24"`97799780    - `"user-profiles-2026-03-24"`97819782    - `"user-profiles-2026-08-18"`97839784    - `"user-profiles-2026-09-04"`97859786    - `"advisor-tool-2026-03-01"`97879788    - `"managed-agents-2026-04-01"`97899790    - `"cache-diagnosis-2026-04-07"`97919792    - `"dreaming-2026-04-21"`97939794    - `"thinking-token-count-2026-05-13"`97959796    - `"server-side-fallback-2026-06-01"`97979798    - `"server-side-fallback-2026-07-01"`97999800    - `"fallback-credit-2026-06-01"`98019802    - `"fallback-credit-2026-07-01"`98039804    - `"agent-memory-2026-07-22"`98059806    - `"mid-conversation-tool-changes-2026-07-01"`98079808    - `"compact-2026-01-12"`98099810    - `"computer-use-2025-11-24"`98119812    - `"mcp-tunnels-2026-06-22"`98139814    - `"structured-outputs-2025-11-13"`98159816    - `"task-budgets-2026-03-13"`98179818    - `"thinking-display-updates-2026-08-18"`98199820    - `"ce-user-management-2026-07-13"`98219822    - `"mid-conversation-output-config-2026-07-01"`98239824    - `"thinking-binding-controls-2026-08-01"`98259826    - `"mid-conversation-system-clear-at-2026-08-21"`98279828    - `"compact-2026-09-04"`98299830#### Body parameters98319832- `service_account_id: string`98339834  Tagged service account ID to add.98359836- `workspace_role: BetaNoBillingWorkspaceRole`98379838  Role to assign to the service account in this workspace.98399840  - `"workspace_admin"`98419842  - `"workspace_developer"`98439844  - `"workspace_restricted_developer"`98459846  - `"workspace_user"`98479848#### Returns98499850- `BetaServiceAccountWorkspaceMember object`98519852  - `type: "service_account_workspace_member"`98539854    default: service_account_workspace_member98559856  - `created_by_actor_id: string or null`98579858    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.98599860  - `implicit: boolean or null`98619862    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.98639864  - `service_account_id: string`98659866    Tagged service account ID (`svac_...`).98679868  - `workspace_id: string`98699870    Tagged workspace ID (`wrkspc_...`).98719872  - `workspace_role: BetaWorkspaceRole`98739874    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.98759876    - `"workspace_admin"`98779878    - `"workspace_billing"`98799880    - `"workspace_developer"`98819882    - `"workspace_restricted_developer"`98839884    - `"workspace_user"`98859886#### Example98879888```bash9889curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts \9890    -H 'Content-Type: application/json' \9891    -H 'anthropic-version: 2023-06-01' \9892    -H "X-Api-Key: $ANTHROPIC_API_KEY" \9893    -d '{9894          "service_account_id": "service_account_id",9895          "workspace_role": "workspace_admin"9896        }'9897```98989899##### Response (200)99009901```json9902{9903  "created_by_actor_id": "created_by_actor_id",9904  "implicit": true,9905  "service_account_id": "service_account_id",9906  "type": "service_account_workspace_member",9907  "workspace_id": "workspace_id",9908  "workspace_role": "workspace_admin"9909}9910```99119912### Get Service Account Workspace Member99139914**GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`99159916**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).99179918Retrieve a service account's membership in a workspace.99199920Returns the membership record, including the service account's9921`workspace_role` in this workspace. Archived workspaces return 400. For9922the default workspace, returns the implicit (`implicit: true`)9923membership when no explicit membership exists; an explicitly added9924membership is returned with its assigned role. An archived service9925account returns 404.99269927#### Path parameters99289929- `workspace_id: string`99309931  ID of the workspace.99329933- `service_account_id: string`99349935  ID of the service account.99369937#### Headers99389939- `"anthropic-beta": optional array of AnthropicBeta`99409941  Optional header to specify the beta version(s) you want to use.99429943  - `string`99449945  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`99469947    - `"message-batches-2024-09-24"`99489949    - `"prompt-caching-2024-07-31"`99509951    - `"computer-use-2024-10-22"`99529953    - `"computer-use-2025-01-24"`99549955    - `"pdfs-2024-09-25"`99569957    - `"token-counting-2024-11-01"`99589959    - `"token-efficient-tools-2025-02-19"`99609961    - `"output-128k-2025-02-19"`99629963    - `"files-api-2025-04-14"`99649965    - `"mcp-client-2025-04-04"`99669967    - `"mcp-client-2025-11-20"`99689969    - `"dev-full-thinking-2025-05-14"`99709971    - `"interleaved-thinking-2025-05-14"`99729973    - `"code-execution-2025-05-22"`99749975    - `"extended-cache-ttl-2025-04-11"`99769977    - `"context-1m-2025-08-07"`99789979    - `"context-management-2025-06-27"`99809981    - `"model-context-window-exceeded-2025-08-26"`99829983    - `"skills-2025-10-02"`99849985    - `"fast-mode-2026-02-01"`99869987    - `"output-300k-2026-03-24"`99889989    - `"user-profiles-2026-03-24"`99909991    - `"user-profiles-2026-08-18"`99929993    - `"user-profiles-2026-09-04"`99949995    - `"advisor-tool-2026-03-01"`99969997    - `"managed-agents-2026-04-01"`99989999    - `"cache-diagnosis-2026-04-07"`1000010001    - `"dreaming-2026-04-21"`1000210003    - `"thinking-token-count-2026-05-13"`1000410005    - `"server-side-fallback-2026-06-01"`1000610007    - `"server-side-fallback-2026-07-01"`1000810009    - `"fallback-credit-2026-06-01"`1001010011    - `"fallback-credit-2026-07-01"`1001210013    - `"agent-memory-2026-07-22"`1001410015    - `"mid-conversation-tool-changes-2026-07-01"`1001610017    - `"compact-2026-01-12"`1001810019    - `"computer-use-2025-11-24"`1002010021    - `"mcp-tunnels-2026-06-22"`1002210023    - `"structured-outputs-2025-11-13"`1002410025    - `"task-budgets-2026-03-13"`1002610027    - `"thinking-display-updates-2026-08-18"`1002810029    - `"ce-user-management-2026-07-13"`1003010031    - `"mid-conversation-output-config-2026-07-01"`1003210033    - `"thinking-binding-controls-2026-08-01"`1003410035    - `"mid-conversation-system-clear-at-2026-08-21"`1003610037    - `"compact-2026-09-04"`1003810039#### Returns1004010041- `BetaServiceAccountWorkspaceMember object`1004210043  - `type: "service_account_workspace_member"`1004410045    default: service_account_workspace_member1004610047  - `created_by_actor_id: string or null`1004810049    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.1005010051  - `implicit: boolean or null`1005210053    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.1005410055  - `service_account_id: string`1005610057    Tagged service account ID (`svac_...`).1005810059  - `workspace_id: string`1006010061    Tagged workspace ID (`wrkspc_...`).1006210063  - `workspace_role: BetaWorkspaceRole`1006410065    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.1006610067    - `"workspace_admin"`1006810069    - `"workspace_billing"`1007010071    - `"workspace_developer"`1007210073    - `"workspace_restricted_developer"`1007410075    - `"workspace_user"`1007610077#### Example1007810079```bash10080curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \10081    -H 'anthropic-version: 2023-06-01' \10082    -H "X-Api-Key: $ANTHROPIC_API_KEY"10083```1008410085##### Response (200)1008610087```json10088{10089  "created_by_actor_id": "created_by_actor_id",10090  "implicit": true,10091  "service_account_id": "service_account_id",10092  "type": "service_account_workspace_member",10093  "workspace_id": "workspace_id",10094  "workspace_role": "workspace_admin"10095}10096```1009710098### Update Service Account Workspace Member1009910100**POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`1010110102**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).1010310104Change a service account's role in a workspace.1010510106The new `workspace_role` replaces the current one. Only explicit10107memberships can be updated; to set a role on the implicit10108default-workspace membership, add the service account explicitly with10109`POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces10110return 400. Archived service accounts cannot be updated and are10111rejected.1011210113#### Path parameters1011410115- `workspace_id: string`1011610117  ID of the workspace.1011810119- `service_account_id: string`1012010121  ID of the service account.1012210123#### Headers1012410125- `"anthropic-beta": optional array of AnthropicBeta`1012610127  Optional header to specify the beta version(s) you want to use.1012810129  - `string`1013010131  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`1013210133    - `"message-batches-2024-09-24"`1013410135    - `"prompt-caching-2024-07-31"`1013610137    - `"computer-use-2024-10-22"`1013810139    - `"computer-use-2025-01-24"`1014010141    - `"pdfs-2024-09-25"`1014210143    - `"token-counting-2024-11-01"`1014410145    - `"token-efficient-tools-2025-02-19"`1014610147    - `"output-128k-2025-02-19"`1014810149    - `"files-api-2025-04-14"`1015010151    - `"mcp-client-2025-04-04"`1015210153    - `"mcp-client-2025-11-20"`1015410155    - `"dev-full-thinking-2025-05-14"`1015610157    - `"interleaved-thinking-2025-05-14"`1015810159    - `"code-execution-2025-05-22"`1016010161    - `"extended-cache-ttl-2025-04-11"`1016210163    - `"context-1m-2025-08-07"`1016410165    - `"context-management-2025-06-27"`1016610167    - `"model-context-window-exceeded-2025-08-26"`1016810169    - `"skills-2025-10-02"`1017010171    - `"fast-mode-2026-02-01"`1017210173    - `"output-300k-2026-03-24"`1017410175    - `"user-profiles-2026-03-24"`1017610177    - `"user-profiles-2026-08-18"`1017810179    - `"user-profiles-2026-09-04"`1018010181    - `"advisor-tool-2026-03-01"`1018210183    - `"managed-agents-2026-04-01"`1018410185    - `"cache-diagnosis-2026-04-07"`1018610187    - `"dreaming-2026-04-21"`1018810189    - `"thinking-token-count-2026-05-13"`1019010191    - `"server-side-fallback-2026-06-01"`1019210193    - `"server-side-fallback-2026-07-01"`1019410195    - `"fallback-credit-2026-06-01"`1019610197    - `"fallback-credit-2026-07-01"`1019810199    - `"agent-memory-2026-07-22"`1020010201    - `"mid-conversation-tool-changes-2026-07-01"`1020210203    - `"compact-2026-01-12"`1020410205    - `"computer-use-2025-11-24"`1020610207    - `"mcp-tunnels-2026-06-22"`1020810209    - `"structured-outputs-2025-11-13"`1021010211    - `"task-budgets-2026-03-13"`1021210213    - `"thinking-display-updates-2026-08-18"`1021410215    - `"ce-user-management-2026-07-13"`1021610217    - `"mid-conversation-output-config-2026-07-01"`1021810219    - `"thinking-binding-controls-2026-08-01"`1022010221    - `"mid-conversation-system-clear-at-2026-08-21"`1022210223    - `"compact-2026-09-04"`1022410225#### Body parameters1022610227- `workspace_role: BetaNoBillingWorkspaceRole`1022810229  New role for the service account in this workspace.1023010231  - `"workspace_admin"`1023210233  - `"workspace_developer"`1023410235  - `"workspace_restricted_developer"`1023610237  - `"workspace_user"`1023810239#### Returns1024010241- `BetaServiceAccountWorkspaceMember object`1024210243  - `type: "service_account_workspace_member"`1024410245    default: service_account_workspace_member1024610247  - `created_by_actor_id: string or null`1024810249    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.1025010251  - `implicit: boolean or null`1025210253    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.1025410255  - `service_account_id: string`1025610257    Tagged service account ID (`svac_...`).1025810259  - `workspace_id: string`1026010261    Tagged workspace ID (`wrkspc_...`).1026210263  - `workspace_role: BetaWorkspaceRole`1026410265    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.1026610267    - `"workspace_admin"`1026810269    - `"workspace_billing"`1027010271    - `"workspace_developer"`1027210273    - `"workspace_restricted_developer"`1027410275    - `"workspace_user"`1027610277#### Example1027810279```bash10280curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \10281    -H 'Content-Type: application/json' \10282    -H 'anthropic-version: 2023-06-01' \10283    -H "X-Api-Key: $ANTHROPIC_API_KEY" \10284    -d '{10285          "workspace_role": "workspace_admin"10286        }'10287```1028810289##### Response (200)1029010291```json10292{10293  "created_by_actor_id": "created_by_actor_id",10294  "implicit": true,10295  "service_account_id": "service_account_id",10296  "type": "service_account_workspace_member",10297  "workspace_id": "workspace_id",10298  "workspace_role": "workspace_admin"10299}10300```1030110302### Delete Service Account Workspace Member1030310304**DELETE** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`1030510306**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).1030710308Remove a service account from a workspace.1030910310Removal is idempotent (returns 200 even if the membership was already10311removed). A DELETE against the implicit default-workspace membership10312returns 200 but is a no-op and the membership persists; deleting an10313explicit default-workspace row reverts to the implicit `workspace_user`10314membership. Archived workspaces return 400.1031510316#### Path parameters1031710318- `workspace_id: string`1031910320  ID of the workspace.1032110322- `service_account_id: string`1032310324  ID of the service account.1032510326#### Headers1032710328- `"anthropic-beta": optional array of AnthropicBeta`1032910330  Optional header to specify the beta version(s) you want to use.1033110332  - `string`1033310334  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`1033510336    - `"message-batches-2024-09-24"`1033710338    - `"prompt-caching-2024-07-31"`1033910340    - `"computer-use-2024-10-22"`1034110342    - `"computer-use-2025-01-24"`1034310344    - `"pdfs-2024-09-25"`1034510346    - `"token-counting-2024-11-01"`1034710348    - `"token-efficient-tools-2025-02-19"`1034910350    - `"output-128k-2025-02-19"`1035110352    - `"files-api-2025-04-14"`1035310354    - `"mcp-client-2025-04-04"`1035510356    - `"mcp-client-2025-11-20"`1035710358    - `"dev-full-thinking-2025-05-14"`1035910360    - `"interleaved-thinking-2025-05-14"`1036110362    - `"code-execution-2025-05-22"`1036310364    - `"extended-cache-ttl-2025-04-11"`1036510366    - `"context-1m-2025-08-07"`1036710368    - `"context-management-2025-06-27"`1036910370    - `"model-context-window-exceeded-2025-08-26"`1037110372    - `"skills-2025-10-02"`1037310374    - `"fast-mode-2026-02-01"`1037510376    - `"output-300k-2026-03-24"`1037710378    - `"user-profiles-2026-03-24"`1037910380    - `"user-profiles-2026-08-18"`1038110382    - `"user-profiles-2026-09-04"`1038310384    - `"advisor-tool-2026-03-01"`1038510386    - `"managed-agents-2026-04-01"`1038710388    - `"cache-diagnosis-2026-04-07"`1038910390    - `"dreaming-2026-04-21"`1039110392    - `"thinking-token-count-2026-05-13"`1039310394    - `"server-side-fallback-2026-06-01"`1039510396    - `"server-side-fallback-2026-07-01"`1039710398    - `"fallback-credit-2026-06-01"`1039910400    - `"fallback-credit-2026-07-01"`1040110402    - `"agent-memory-2026-07-22"`1040310404    - `"mid-conversation-tool-changes-2026-07-01"`1040510406    - `"compact-2026-01-12"`1040710408    - `"computer-use-2025-11-24"`1040910410    - `"mcp-tunnels-2026-06-22"`1041110412    - `"structured-outputs-2025-11-13"`1041310414    - `"task-budgets-2026-03-13"`1041510416    - `"thinking-display-updates-2026-08-18"`1041710418    - `"ce-user-management-2026-07-13"`1041910420    - `"mid-conversation-output-config-2026-07-01"`1042110422    - `"thinking-binding-controls-2026-08-01"`1042310424    - `"mid-conversation-system-clear-at-2026-08-21"`1042510426    - `"compact-2026-09-04"`1042710428#### Returns1042910430- `type: "service_account_workspace_member_deleted"`1043110432  default: service_account_workspace_member_deleted1043310434- `service_account_id: string`1043510436  Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op.1043710438- `workspace_id: string`1043910440  Tagged workspace ID (`wrkspc_...`) named in the delete request.1044110442#### Example1044310444```bash10445curl https://api.anthropic.com/v1/organizations/workspaces/$WORKSPACE_ID/service_accounts/$SERVICE_ACCOUNT_ID \10446    -X DELETE \10447    -H 'anthropic-version: 2023-06-01' \10448    -H "X-Api-Key: $ANTHROPIC_API_KEY"10449```1045010451##### Response (200)1045210453```json10454{10455  "service_account_id": "service_account_id",10456  "type": "service_account_workspace_member_deleted",10457  "workspace_id": "workspace_id"10458}10459```1046010461## Organization › Rate Limits1046210463### List Organization Rate Limits1046410465**GET** `/v1/organizations/rate_limits`1046610467List Messages API rate limits for your organization.1046810469Each entry corresponds to one rate-limit group (either a model family10470or an API-surface category such as the Files API or Message Batches)10471and contains the set of limiter values that apply to it.1047210473When `limit` is omitted, every matching entry is returned in a single10474page; when `limit` truncates the result, follow `next_page` to fetch10475the remaining entries.1047610477#### Query parameters1047810479- `group_type: optional "batch" or "files" or "model_group" or 3 more`1048010481  Filter by group type.1048210483  - `"batch"`1048410485  - `"files"`1048610487  - `"model_group"`1048810489  - `"skills"`1049010491  - `"token_count"`1049210493  - `"web_search"`1049410495- `limit: optional number`1049610497  Maximum number of items to return per page. Ranges from `1` to `1000`.1049810499  When omitted, every remaining entry is returned in a single page and `next_page` is `null`.1050010501  maximum: 1000, minimum: 11050210503- `model: optional string`1050410505  Filter to the single entry containing this model. Accepts full model names and aliases. Returns 404 if the model is not found or has no rate limits for this organization.1050610507- `page: optional string`1050810509  Opaque cursor from a previous response's `next_page`.1051010511#### Returns1051210513- `data: array of BetaOrganizationRateLimit`1051410515  Rate-limit entries for the organization, one per group.1051610517  - `type: "rate_limit"`1051810519    Object type. Always `rate_limit` for organization rate-limit entries.1052010521    default: rate_limit1052210523  - `id: string`1052410525    Stable identifier for this rate-limit group within the organization.1052610527  - `group_type: "batch" or "files" or "model_group" or 3 more`1052810529    The kind of rate-limit group this entry represents. `model_group` entries apply to a family of models (listed in `models`); other values apply to an API-surface category and have `models` set to `null`.1053010531    - `"batch"`1053210533    - `"files"`1053410535    - `"model_group"`1053610537    - `"skills"`1053810539    - `"token_count"`1054010541    - `"web_search"`1054210543  - `limits: array of BetaOrganizationRateLimitValue`1054410545    The limiter values that apply to this group.1054610547    - `type: string`1054810549      The limiter type (for example, `requests_per_minute` or `input_tokens_per_minute`).1055010551    - `value: number`1055210553      The configured limit value for this limiter type.1055410555  - `models: array of string or null`1055610557    Model names this entry's limits apply to, including aliases. `null` when `group_type` is not `"model_group"`.1055810559- `next_page: string or null`1056010561  Opaque cursor for the next page of results, or `null` when no entries remain beyond this response.1056210563#### Example1056410565```bash10566curl https://api.anthropic.com/v1/organizations/rate_limits \10567    -H 'anthropic-version: 2023-06-01' \10568    -H "X-Api-Key: $ANTHROPIC_API_KEY"10569```1057010571##### Response (200)1057210573```json10574{10575  "data": [10576    {10577      "id": "id",10578      "group_type": "batch",10579      "limits": [10580        {10581          "type": "type",10582          "value": 010583        }10584      ],10585      "models": [10586        "string"10587      ],10588      "type": "rate_limit"10589    }10590  ],10591  "next_page": "next_page"10592}10593```1059410595## Organization › Compliance Settings1059610597### Get Compliance Settings1059810599**GET** `/v1/organizations/compliance_settings`1060010601Retrieve your organization's Compliance Settings.1060210603Compliance Settings is a singleton resource: there is exactly one per10604organization, addressed without an identifier. The `state` field reflects10605whether the Compliance API is enabled. An organization with a parent10606organization reads the state inherited from the parent's configuration.1060710608#### Returns1060910610- `BetaComplianceSettings object`1061110612  - `type: "compliance_settings"`1061310614    default: compliance_settings1061510616  - `state: BetaComplianceSettingsState`1061710618    Whether the Compliance API is enabled for this organization.1061910620    - `BetaComplianceSettingsStateEnabled object`1062110622      - `type: "enabled"`1062310624        default: enabled1062510626    - `BetaComplianceSettingsStateDisabled object`1062710628      - `type: "disabled"`1062910630        default: disabled1063110632#### Example1063310634```bash10635curl https://api.anthropic.com/v1/organizations/compliance_settings \10636    -H 'anthropic-version: 2023-06-01' \10637    -H "X-Api-Key: $ANTHROPIC_API_KEY"10638```1063910640##### Response (200)1064110642```json10643{10644  "state": {10645    "type": "enabled"10646  },10647  "type": "compliance_settings"10648}10649```1065010651### Update Compliance Settings1065210653**POST** `/v1/organizations/compliance_settings`1065410655Update your organization's Compliance Settings.1065610657Setting `state` to `enabled` turns on the Compliance API and begins10658capturing organization activity events. Setting it to `disabled` turns10659both off. `state` reflects whether the Compliance API is enabled.1066010661A request that sets `state` to its current value succeeds and leaves the10662resource unchanged. A `disabled` request stays in effect until a later10663`enabled` request or the organization's next provisioning action that10664enables Access Transparency: enabling Access Transparency also enables10665the Compliance API, which serves its activity events, so such10666provisioning (including re-runs) re-enables the Compliance API even10667after a `disabled` request. Automated provisioning never disables10668compliance settings.1066910670#### Body parameters1067110672- `state: BetaComplianceSettingsStateParam`1067310674  Desired state. Accepts the string shorthand "enabled" or "disabled" in place of the object form; the response always returns the canonical object form.1067510676  - `BetaComplianceSettingsStateEnabledParam object`1067710678    - `type: "enabled"`1067910680  - `BetaComplianceSettingsStateDisabledParam object`1068110682    - `type: "disabled"`1068310684#### Returns1068510686- `BetaComplianceSettings object`1068710688  - `type: "compliance_settings"`1068910690    default: compliance_settings1069110692  - `state: BetaComplianceSettingsState`1069310694    Whether the Compliance API is enabled for this organization.1069510696    - `BetaComplianceSettingsStateEnabled object`1069710698      - `type: "enabled"`1069910700        default: enabled1070110702    - `BetaComplianceSettingsStateDisabled object`1070310704      - `type: "disabled"`1070510706        default: disabled1070710708#### Example1070910710```bash10711curl https://api.anthropic.com/v1/organizations/compliance_settings \10712    -H 'Content-Type: application/json' \10713    -H 'anthropic-version: 2023-06-01' \10714    -H "X-Api-Key: $ANTHROPIC_API_KEY" \10715    -d '{10716          "state": {10717            "type": "enabled"10718          }10719        }'10720```1072110722##### Response (200)1072310724```json10725{10726  "state": {10727    "type": "enabled"10728  },10729  "type": "compliance_settings"10730}10731```1073210733## Organization › Usage Report1073410735### Get Messages Usage Report1073610737**GET** `/v1/organizations/usage_report/messages`1073810739Get Messages Usage Report1074010741#### Query parameters1074210743- `starting_at: string`1074410745  Time buckets that start on or after this RFC 3339 timestamp will be returned.10746  Each time bucket will be snapped to the start of the minute/hour/day in UTC.1074710748  format: date-time1074910750- `account_ids: optional array of string`1075110752  Restrict usage returned to the specified user account ID(s).1075310754- `api_key_ids: optional array of string`1075510756  Restrict usage returned to the specified API key ID(s).1075710758- `bucket_width: optional "1d" or "1h" or "1m"`1075910760  Time granularity of the response data.1076110762  default: 1d1076310764  - `"1d"`1076510766  - `"1h"`1076710768  - `"1m"`1076910770- `context_window: optional array of "0-200k" or "200k-1M"`1077110772  Restrict usage returned to the specified context window(s).1077310774  - `"0-200k"`1077510776  - `"200k-1M"`1077710778- `ending_at: optional string`1077910780  Time buckets that end before this RFC 3339 timestamp will be returned.1078110782  format: date-time1078310784- `group_by: optional array of "account_id" or "api_key_id" or "context_window" or 6 more`1078510786  Group by any subset of the available options. Grouping by `speed` requires the `fast-mode-2026-02-01` beta header.1078710788  - `"account_id"`1078910790  - `"api_key_id"`1079110792  - `"context_window"`1079310794  - `"inference_geo"`1079510796  - `"model"`1079710798  - `"service_account_id"`1079910800  - `"service_tier"`1080110802  - `"speed"`1080310804  - `"workspace_id"`1080510806- `inference_geos: optional array of "global" or "not_available" or "us"`1080710808  Restrict usage returned to the specified inference geo(s). Use `not_available` for models that do not support specifying `inference_geo`.1080910810  - `"global"`1081110812  - `"not_available"`1081310814  - `"us"`1081510816- `limit: optional number`1081710818  Maximum number of time buckets to return in the response.1081910820  The default and max limits depend on `bucket_width`:10821  • `"1d"`: Default of 7 days, maximum of 31 days10822  • `"1h"`: Default of 24 hours, maximum of 168 hours10823  • `"1m"`: Default of 60 minutes, maximum of 1440 minutes1082410825- `models: optional array of string`1082610827  Restrict usage returned to the specified model(s).1082810829- `page: optional string`1083010831  Optionally set to the `next_page` token from the previous response.1083210833- `service_account_ids: optional array of string`1083410835  Restrict usage returned to the specified service account ID(s).1083610837- `service_tiers: optional array of "batch" or "flex" or "flex_discount" or 3 more`1083810839  Restrict usage returned to the specified service tier(s).1084010841  - `"batch"`1084210843  - `"flex"`1084410845  - `"flex_discount"`1084610847  - `"priority"`1084810849  - `"priority_on_demand"`1085010851  - `"standard"`1085210853- `speeds: optional array of "standard" or "fast"`1085410855  Restrict usage returned to the specified speed(s) (Claude Code research preview).10856  Requires the `fast-mode-2026-02-01` beta header.1085710858  - `"standard"`1085910860  - `"fast"`1086110862- `workspace_ids: optional array of string`1086310864  Restrict usage returned to the specified workspace ID(s).1086510866#### Headers1086710868- `"anthropic-beta": optional array of AnthropicBeta`1086910870  Optional header to specify the beta version(s) you want to use.1087110872  - `string`1087310874  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`1087510876    - `"message-batches-2024-09-24"`1087710878    - `"prompt-caching-2024-07-31"`1087910880    - `"computer-use-2024-10-22"`1088110882    - `"computer-use-2025-01-24"`1088310884    - `"pdfs-2024-09-25"`1088510886    - `"token-counting-2024-11-01"`1088710888    - `"token-efficient-tools-2025-02-19"`1088910890    - `"output-128k-2025-02-19"`1089110892    - `"files-api-2025-04-14"`1089310894    - `"mcp-client-2025-04-04"`1089510896    - `"mcp-client-2025-11-20"`1089710898    - `"dev-full-thinking-2025-05-14"`1089910900    - `"interleaved-thinking-2025-05-14"`1090110902    - `"code-execution-2025-05-22"`1090310904    - `"extended-cache-ttl-2025-04-11"`1090510906    - `"context-1m-2025-08-07"`1090710908    - `"context-management-2025-06-27"`1090910910    - `"model-context-window-exceeded-2025-08-26"`1091110912    - `"skills-2025-10-02"`1091310914    - `"fast-mode-2026-02-01"`1091510916    - `"output-300k-2026-03-24"`1091710918    - `"user-profiles-2026-03-24"`1091910920    - `"user-profiles-2026-08-18"`1092110922    - `"user-profiles-2026-09-04"`1092310924    - `"advisor-tool-2026-03-01"`1092510926    - `"managed-agents-2026-04-01"`1092710928    - `"cache-diagnosis-2026-04-07"`1092910930    - `"dreaming-2026-04-21"`1093110932    - `"thinking-token-count-2026-05-13"`1093310934    - `"server-side-fallback-2026-06-01"`1093510936    - `"server-side-fallback-2026-07-01"`1093710938    - `"fallback-credit-2026-06-01"`1093910940    - `"fallback-credit-2026-07-01"`1094110942    - `"agent-memory-2026-07-22"`1094310944    - `"mid-conversation-tool-changes-2026-07-01"`1094510946    - `"compact-2026-01-12"`1094710948    - `"computer-use-2025-11-24"`1094910950    - `"mcp-tunnels-2026-06-22"`1095110952    - `"structured-outputs-2025-11-13"`1095310954    - `"task-budgets-2026-03-13"`1095510956    - `"thinking-display-updates-2026-08-18"`1095710958    - `"ce-user-management-2026-07-13"`1095910960    - `"mid-conversation-output-config-2026-07-01"`1096110962    - `"thinking-binding-controls-2026-08-01"`1096310964    - `"mid-conversation-system-clear-at-2026-08-21"`1096510966    - `"compact-2026-09-04"`1096710968#### Returns1096910970- `BetaMessagesUsageReport object`1097110972  - `data: array of object`1097310974    List of time buckets for this page, oldest first: one per `bucket_width` interval, including intervals with no usage (their `results` list is empty). A page holds at most `limit` buckets.1097510976    - `ending_at: string`1097710978      End of the time bucket (exclusive) in RFC 3339 format.1097910980      format: date-time1098110982    - `results: array of object`1098310984      List of usage items for this time bucket.  There may be multiple items if one or more `group_by[]` parameters are specified.1098510986      - `account_id: string or null`1098710988        ID of the user account that made the request. `null` if not grouping by account or for non-OAuth requests.1098910990      - `api_key_id: string or null`1099110992        ID of the API key used. `null` if not grouping by API key or for usage in the Anthropic Console.1099310994      - `cache_creation: BetaCacheCreation`1099510996        The number of input tokens for cache creation.1099710998        - `ephemeral_1h_input_tokens: number`1099911000          The number of input tokens used to create the 1 hour cache entry.1100111002          default: 0, minimum: 01100311004        - `ephemeral_5m_input_tokens: number`1100511006          The number of input tokens used to create the 5 minute cache entry.1100711008          default: 0, minimum: 01100911010      - `cache_read_input_tokens: number`1101111012        The number of input tokens read from the cache.1101311014      - `context_window: "0-200k" or "200k-1M" or null`1101511016        Context window used. `null` if not grouping by context window.1101711018        - `"0-200k"`1101911020        - `"200k-1M"`1102111022      - `inference_geo: "global" or "not_available" or "us" or null`1102311024        Inference geo used matching requests' `inference_geo` parameter if set, otherwise the workspace's `default_inference_geo`.11025        For models that do not support specifying `inference_geo` the value is `"not_available"`. Always `null` if not grouping by inference geo.1102611027        - `"global"`1102811029        - `"not_available"`1103011031        - `"us"`1103211033      - `model: string or null`1103411035        Model used. `null` if not grouping by model.1103611037      - `output_tokens: number`1103811039        The number of output tokens generated.1104011041      - `server_tool_use: object`1104211043        Server-side tool usage metrics.1104411045        - `web_search_requests: number`1104611047          The number of web search requests made.1104811049      - `service_account_id: string or null`1105011051        ID of the service account that made the request. `null` if not grouping by service account or for non-OIDC-federation requests.1105211053      - `service_tier: "batch" or "flex" or "flex_discount" or 3 more or null`1105411055        Service tier used. `null` if not grouping by service tier.1105611057        - `"batch"`1105811059        - `"flex"`1106011061        - `"flex_discount"`1106211063        - `"priority"`1106411065        - `"priority_on_demand"`1106611067        - `"standard"`1106811069      - `uncached_input_tokens: number`1107011071        The number of uncached input tokens processed.1107211073      - `workspace_id: string or null`1107411075        ID of the Workspace used. `null` if not grouping by workspace or for the default workspace.1107611077    - `starting_at: string`1107811079      Start of the time bucket (inclusive) in RFC 3339 format.1108011081      format: date-time1108211083  - `has_more: boolean`1108411085    Indicates if there are more results.1108611087  - `next_page: string or null`1108811089    Opaque cursor for the next page, or `null` when `has_more` is false. Pass it as the `page` parameter in the next request.1109011091#### Example1109211093```bash11094curl https://api.anthropic.com/v1/organizations/usage_report/messages \11095    -H 'anthropic-version: 2023-06-01' \11096    -H "X-Api-Key: $ANTHROPIC_API_KEY"11097```1109811099##### Response (200)1110011101```json11102{11103  "data": [11104    {11105      "ending_at": "2025-08-02T00:00:00Z",11106      "results": [11107        {11108          "account_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",11109          "api_key_id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",11110          "cache_creation": {11111            "ephemeral_1h_input_tokens": 0,11112            "ephemeral_5m_input_tokens": 011113          },11114          "cache_read_input_tokens": 200,11115          "context_window": "0-200k",11116          "inference_geo": "global",11117          "model": "claude-opus-5",11118          "output_tokens": 500,11119          "server_tool_use": {11120            "web_search_requests": 1011121          },11122          "service_account_id": "svac_01Hk3R9TWxq7CfQak00OiVw4",11123          "service_tier": "standard",11124          "uncached_input_tokens": 1500,11125          "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"11126        }11127      ],11128      "starting_at": "2025-08-01T00:00:00Z"11129    }11130  ],11131  "has_more": true,11132  "next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo="11133}11134```1113511136### Get Claude Code Usage Report1113711138**GET** `/v1/organizations/usage_report/claude_code`1113911140Retrieve daily aggregated usage metrics for Claude Code users.11141Enables organizations to analyze developer productivity and build custom dashboards.1114211143#### Query parameters1114411145- `starting_at: string`1114611147  UTC date in YYYY-MM-DD format. Returns metrics for this single day only.1114811149  pattern: ^\d{4}-\d{2}-\d{2}$, format: date1115011151- `limit: optional number`1115211153  Number of records per page (default: 20, max: 1000).1115411155  default: 20, maximum: 1000, minimum: 11115611157- `page: optional string`1115811159  Opaque cursor token from previous response's `next_page` field.1116011161#### Returns1116211163- `BetaClaudeCodeUsageReport object`1116411165  - `data: array of object`1116611167    List of Claude Code usage records for the requested date.1116811169    - `actor: UserActor or APIActor`1117011171      The user or API key that performed the Claude Code actions.1117211173      - `UserActor object`1117411175        - `type: "user_actor"`1117611177          Actor type. Always `"user_actor"` for a user.1117811179        - `email_address: string`1118011181          Email address of the user who performed Claude Code actions.1118211183      - `APIActor object`1118411185        - `type: "api_actor"`1118611187          Actor type. Always `"api_actor"` for an API key.1118811189        - `api_key_name: string`1119011191          Name of the API key used to perform Claude Code actions.1119211193    - `core_metrics: object`1119411195      Core productivity metrics measuring Claude Code usage and impact.1119611197      - `commits_by_claude_code: number`1119811199        Number of git commits created through Claude Code's commit functionality.1120011201      - `lines_of_code: object`1120211203        Statistics on code changes made through Claude Code.1120411205        - `added: number`1120611207          Total number of lines of code added across all files by Claude Code.1120811209        - `removed: number`1121011211          Total number of lines of code removed across all files by Claude Code.1121211213      - `num_sessions: number`1121411215        Number of distinct Claude Code sessions initiated by this actor.1121611217      - `pull_requests_by_claude_code: number`1121811219        Number of pull requests created through Claude Code's PR functionality.1122011221    - `customer_type: "api" or "subscription"`1122211223      Type of customer account (api for API customers, subscription for Pro/Team customers).1122411225      - `"api"`1122611227      - `"subscription"`1122811229    - `date: string`1123011231      UTC day the usage metrics cover, as an RFC 3339 timestamp at midnight UTC11232      (for example `2025-08-08T00:00:00Z`).1123311234      format: date-time1123511236    - `is_remote: boolean`1123711238      Whether the usage came from remote Claude Code sessions, such as Claude Code11239      on the web. Remote and local usage are reported as separate rows.1124011241    - `model_breakdown: array of object`1124211243      Token usage and cost breakdown by AI model used.1124411245      - `estimated_cost: object`1124611247        Estimated cost for using this model1124811249        - `amount: number`1125011251          Estimated cost amount in minor currency units (e.g., cents for USD).1125211253        - `currency: string`1125411255          Currency code for the estimated cost (e.g., 'USD').1125611257      - `model: string`1125811259        Name of the AI model used for Claude Code interactions.1126011261      - `tokens: object`1126211263        Token usage breakdown for this model1126411265        - `cache_creation: number`1126611267          Number of cache creation tokens consumed by this model.1126811269        - `cache_read: number`1127011271          Number of cache read tokens consumed by this model.1127211273        - `input: number`1127411275          Number of input tokens consumed by this model.1127611277        - `output: number`1127811279          Number of output tokens generated by this model.1128011281    - `organization_id: string`1128211283      ID of the organization that owns the Claude Code usage.1128411285    - `terminal_type: string`1128611287      Type of terminal or environment where Claude Code was used.1128811289    - `tool_actions: map[object]`1129011291      Breakdown of tool action acceptance and rejection rates by tool type.1129211293      - `accepted: number`1129411295        Number of tool action proposals that the user accepted.1129611297      - `rejected: number`1129811299        Number of tool action proposals that the user rejected.1130011301    - `subscription_type: optional "enterprise" or "team" or null`1130211303      Subscription tier for subscription customers. `null` for API customers.1130411305      - `"enterprise"`1130611307      - `"team"`1130811309  - `has_more: boolean`1131011311    True if there are more records available beyond the current page.1131211313  - `next_page: string or null`1131411315    Opaque cursor token for fetching the next page of results, or null if no more pages are available.1131611317#### Example1131811319```bash11320curl https://api.anthropic.com/v1/organizations/usage_report/claude_code \11321    -H 'anthropic-version: 2023-06-01' \11322    -H "X-Api-Key: $ANTHROPIC_API_KEY"11323```1132411325##### Response (200)1132611327```json11328{11329  "data": [11330    {11331      "actor": {11332        "email_address": "user@emaildomain.com",11333        "type": "user_actor"11334      },11335      "core_metrics": {11336        "commits_by_claude_code": 8,11337        "lines_of_code": {11338          "added": 342,11339          "removed": 12811340        },11341        "num_sessions": 15,11342        "pull_requests_by_claude_code": 211343      },11344      "customer_type": "api",11345      "date": "2025-08-08T00:00:00Z",11346      "is_remote": false,11347      "model_breakdown": [11348        {11349          "estimated_cost": {11350            "amount": 186,11351            "currency": "USD"11352          },11353          "model": "claude-opus-5",11354          "tokens": {11355            "cache_creation": 2340,11356            "cache_read": 8790,11357            "input": 45230,11358            "output": 1245011359          }11360        },11361        {11362          "estimated_cost": {11363            "amount": 42,11364            "currency": "USD"11365          },11366          "model": "claude-sonnet-5",11367          "tokens": {11368            "cache_creation": 890,11369            "cache_read": 3420,11370            "input": 23100,11371            "output": 568011372          }11373        }11374      ],11375      "organization_id": "12345678-1234-5678-1234-567812345678",11376      "terminal_type": "iTerm.app",11377      "tool_actions": {11378        "edit_tool": {11379          "accepted": 25,11380          "rejected": 311381        },11382        "multi_edit_tool": {11383          "accepted": 12,11384          "rejected": 111385        },11386        "notebook_edit_tool": {11387          "accepted": 5,11388          "rejected": 211389        },11390        "write_tool": {11391          "accepted": 8,11392          "rejected": 011393        }11394      },11395      "subscription_type": "enterprise"11396    }11397  ],11398  "has_more": true,11399  "next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo="11400}11401```1140211403## Organization › Cost Report1140411405### Get Cost Report1140611407**GET** `/v1/organizations/cost_report`1140811409Get Cost Report1141011411#### Query parameters1141211413- `starting_at: string`1141411415  Time buckets that start on or after this RFC 3339 timestamp will be returned.11416  Each time bucket will be snapped to the start of the minute/hour/day in UTC.1141711418  format: date-time1141911420- `bucket_width: optional "1d"`1142111422  Time granularity of the response data.1142311424  default: 1d1142511426- `ending_at: optional string`1142711428  Time buckets that end before this RFC 3339 timestamp will be returned.1142911430  format: date-time1143111432- `group_by: optional array of "description" or "workspace_id"`1143311434  Group by any subset of the available options.1143511436  - `"description"`1143711438  - `"workspace_id"`1143911440- `limit: optional number`1144111442  Maximum number of time buckets to return in the response.1144311444  default: 7, maximum: 31, minimum: 11144511446- `page: optional string`1144711448  Optionally set to the `next_page` token from the previous response.1144911450#### Headers1145111452- `"anthropic-beta": optional array of AnthropicBeta`1145311454  Optional header to specify the beta version(s) you want to use.1145511456  - `string`1145711458  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`1145911460    - `"message-batches-2024-09-24"`1146111462    - `"prompt-caching-2024-07-31"`1146311464    - `"computer-use-2024-10-22"`1146511466    - `"computer-use-2025-01-24"`1146711468    - `"pdfs-2024-09-25"`1146911470    - `"token-counting-2024-11-01"`1147111472    - `"token-efficient-tools-2025-02-19"`1147311474    - `"output-128k-2025-02-19"`1147511476    - `"files-api-2025-04-14"`1147711478    - `"mcp-client-2025-04-04"`1147911480    - `"mcp-client-2025-11-20"`1148111482    - `"dev-full-thinking-2025-05-14"`1148311484    - `"interleaved-thinking-2025-05-14"`1148511486    - `"code-execution-2025-05-22"`1148711488    - `"extended-cache-ttl-2025-04-11"`1148911490    - `"context-1m-2025-08-07"`1149111492    - `"context-management-2025-06-27"`1149311494    - `"model-context-window-exceeded-2025-08-26"`1149511496    - `"skills-2025-10-02"`1149711498    - `"fast-mode-2026-02-01"`1149911500    - `"output-300k-2026-03-24"`1150111502    - `"user-profiles-2026-03-24"`1150311504    - `"user-profiles-2026-08-18"`1150511506    - `"user-profiles-2026-09-04"`1150711508    - `"advisor-tool-2026-03-01"`1150911510    - `"managed-agents-2026-04-01"`1151111512    - `"cache-diagnosis-2026-04-07"`1151311514    - `"dreaming-2026-04-21"`1151511516    - `"thinking-token-count-2026-05-13"`1151711518    - `"server-side-fallback-2026-06-01"`1151911520    - `"server-side-fallback-2026-07-01"`1152111522    - `"fallback-credit-2026-06-01"`1152311524    - `"fallback-credit-2026-07-01"`1152511526    - `"agent-memory-2026-07-22"`1152711528    - `"mid-conversation-tool-changes-2026-07-01"`1152911530    - `"compact-2026-01-12"`1153111532    - `"computer-use-2025-11-24"`1153311534    - `"mcp-tunnels-2026-06-22"`1153511536    - `"structured-outputs-2025-11-13"`1153711538    - `"task-budgets-2026-03-13"`1153911540    - `"thinking-display-updates-2026-08-18"`1154111542    - `"ce-user-management-2026-07-13"`1154311544    - `"mid-conversation-output-config-2026-07-01"`1154511546    - `"thinking-binding-controls-2026-08-01"`1154711548    - `"mid-conversation-system-clear-at-2026-08-21"`1154911550    - `"compact-2026-09-04"`1155111552#### Returns1155311554- `BetaCostReport object`1155511556  - `data: array of object`1155711558    List of time buckets for this page, oldest first: one per `bucket_width` interval, including intervals with no costs (their `results` list is empty). A page holds at most `limit` buckets.1155911560    - `ending_at: string`1156111562      End of the time bucket (exclusive) in RFC 3339 format.1156311564      format: date-time1156511566    - `results: array of object`1156711568      List of cost items for this time bucket. There may be multiple items if one or more `group_by[]` parameters are specified.1156911570      - `amount: string`1157111572        Cost amount in lowest currency units (e.g. cents) as a decimal string. For example, `"123.45"` in `"USD"` represents `$1.23`.1157311574      - `context_window: "0-200k" or "200k-1M" or null`1157511576        Input context window used. `null` if not grouping by description or for non-token costs.1157711578        - `"0-200k"`1157911580        - `"200k-1M"`1158111582      - `cost_type: "code_execution" or "session_usage" or "tokens" or "web_search" or null`1158311584        Type of cost. `null` if not grouping by description.1158511586        - `"code_execution"`1158711588        - `"session_usage"`1158911590        - `"tokens"`1159111592        - `"web_search"`1159311594      - `currency: string`1159511596        Currency code for the cost amount. Currently always `"USD"`.1159711598      - `description: string or null`1159911600        Description of the cost item. `null` if not grouping by description.1160111602      - `inference_geo: "global" or "not_available" or "us" or null`1160311604        Inference geo used matching requests' `inference_geo` parameter if set, otherwise the workspace's `default_inference_geo`.11605        For models that do not support specifying `inference_geo` the value is `"not_available"`. Always `null` if not grouping by inference geo.1160611607        - `"global"`1160811609        - `"not_available"`1161011611        - `"us"`1161211613      - `model: string or null`1161411615        Model name used. `null` if not grouping by description or for non-token costs.1161611617      - `service_tier: "batch" or "standard" or null`1161811619        Service tier used. `null` if not grouping by description or for non-token costs.1162011621        - `"batch"`1162211623        - `"standard"`1162411625      - `token_type: "cache_creation.ephemeral_1h_input_tokens" or "cache_creation.ephemeral_5m_input_tokens" or "cache_read_input_tokens" or 2 more or null`1162611627        Type of token. `null` if not grouping by description or for non-token costs.1162811629        - `"cache_creation.ephemeral_1h_input_tokens"`1163011631        - `"cache_creation.ephemeral_5m_input_tokens"`1163211633        - `"cache_read_input_tokens"`1163411635        - `"output_tokens"`1163611637        - `"uncached_input_tokens"`1163811639      - `workspace_id: string or null`1164011641        ID of the Workspace this cost is associated with. `null` if not grouping by workspace or for the default workspace.1164211643    - `starting_at: string`1164411645      Start of the time bucket (inclusive) in RFC 3339 format.1164611647      format: date-time1164811649  - `has_more: boolean`1165011651    Indicates if there are more results.1165211653  - `next_page: string or null`1165411655    Opaque cursor for the next page, or `null` when `has_more` is false. Pass it as the `page` parameter in the next request.1165611657#### Example1165811659```bash11660curl https://api.anthropic.com/v1/organizations/cost_report \11661    -H 'anthropic-version: 2023-06-01' \11662    -H "X-Api-Key: $ANTHROPIC_API_KEY"11663```1166411665##### Response (200)1166611667```json11668{11669  "data": [11670    {11671      "ending_at": "2025-08-02T00:00:00Z",11672      "results": [11673        {11674          "amount": "123.78912",11675          "context_window": "0-200k",11676          "cost_type": "tokens",11677          "currency": "USD",11678          "description": "Claude Opus 5 Usage - Input Tokens",11679          "inference_geo": "global",11680          "model": "claude-opus-5",11681          "service_tier": "standard",11682          "token_type": "uncached_input_tokens",11683          "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"11684        }11685      ],11686      "starting_at": "2025-08-01T00:00:00Z"11687    }11688  ],11689  "has_more": true,11690  "next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo="11691}11692```1169311694## Organization › MCP Tunnels1169511696### List Tunnels1169711698**GET** `/v1/organizations/tunnels`1169911700**Deprecated**1170111702**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.1170311704List the organization's tunnels.1170511706Results span the caller's organization, ordered by creation time11707(newest first). Use `workspace_id` to filter to a single workspace;11708archived tunnels are excluded unless `include_archived` is set.1170911710#### Query parameters1171111712- `include_archived: optional boolean`1171311714  Include archived tunnels in the results. Archived tunnels are excluded by11715  default.1171611717  default: false1171811719- `limit: optional number`1172011721  Maximum number of tunnels to return in a single page.1172211723  default: 20, maximum: 1000, minimum: 11172411725- `page: optional string`1172611727  Opaque pagination cursor from a previous response's `next_page`. Omit to11728  fetch the first page.1172911730- `workspace_id: optional string`1173111732  Return only tunnels in this Workspace. Accepts a `wrkspc_`-prefixed11733  Workspace ID; omit to list tunnels across all Workspaces.1173411735#### Headers1173611737- `"anthropic-beta": array of AnthropicBeta`1173811739  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.1174011741  - `string`1174211743  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`1174411745    - `"message-batches-2024-09-24"`1174611747    - `"prompt-caching-2024-07-31"`1174811749    - `"computer-use-2024-10-22"`1175011751    - `"computer-use-2025-01-24"`1175211753    - `"pdfs-2024-09-25"`1175411755    - `"token-counting-2024-11-01"`1175611757    - `"token-efficient-tools-2025-02-19"`1175811759    - `"output-128k-2025-02-19"`1176011761    - `"files-api-2025-04-14"`1176211763    - `"mcp-client-2025-04-04"`1176411765    - `"mcp-client-2025-11-20"`1176611767    - `"dev-full-thinking-2025-05-14"`1176811769    - `"interleaved-thinking-2025-05-14"`1177011771    - `"code-execution-2025-05-22"`1177211773    - `"extended-cache-ttl-2025-04-11"`1177411775    - `"context-1m-2025-08-07"`1177611777    - `"context-management-2025-06-27"`1177811779    - `"model-context-window-exceeded-2025-08-26"`1178011781    - `"skills-2025-10-02"`1178211783    - `"fast-mode-2026-02-01"`1178411785    - `"output-300k-2026-03-24"`1178611787    - `"user-profiles-2026-03-24"`1178811789    - `"user-profiles-2026-08-18"`1179011791    - `"user-profiles-2026-09-04"`1179211793    - `"advisor-tool-2026-03-01"`1179411795    - `"managed-agents-2026-04-01"`1179611797    - `"cache-diagnosis-2026-04-07"`1179811799    - `"dreaming-2026-04-21"`1180011801    - `"thinking-token-count-2026-05-13"`1180211803    - `"server-side-fallback-2026-06-01"`1180411805    - `"server-side-fallback-2026-07-01"`1180611807    - `"fallback-credit-2026-06-01"`1180811809    - `"fallback-credit-2026-07-01"`1181011811    - `"agent-memory-2026-07-22"`1181211813    - `"mid-conversation-tool-changes-2026-07-01"`1181411815    - `"compact-2026-01-12"`1181611817    - `"computer-use-2025-11-24"`1181811819    - `"mcp-tunnels-2026-06-22"`1182011821    - `"structured-outputs-2025-11-13"`1182211823    - `"task-budgets-2026-03-13"`1182411825    - `"thinking-display-updates-2026-08-18"`1182611827    - `"ce-user-management-2026-07-13"`1182811829    - `"mid-conversation-output-config-2026-07-01"`1183011831    - `"thinking-binding-controls-2026-08-01"`1183211833    - `"mid-conversation-system-clear-at-2026-08-21"`1183411835    - `"compact-2026-09-04"`1183611837#### Returns1183811839- `data: array of BetaOrganizationTunnel`1184011841  - `type: "tunnel"`1184211843    Object type. Always `tunnel` for Tunnels.1184411845    default: tunnel1184611847  - `id: string`1184811849    ID of the Tunnel.1185011851  - `archived_at: string or null`1185211853    RFC 3339 datetime string indicating when the Tunnel was archived, or11854    `null` if it is not archived.1185511856    format: date-time1185711858  - `created_at: string`1185911860    RFC 3339 datetime string indicating when the Tunnel was created.1186111862    format: date-time1186311864  - `display_name: string or null`1186511866    Human-readable name for the Tunnel (1–255 characters), or `null` if unset.1186711868  - `domain: string`1186911870    Anthropic-assigned hostname for the Tunnel. MCP server URLs whose host is a11871    subdomain of this value are routed through the Tunnel. Globally unique and11872    never reused, even after the Tunnel is archived.1187311874  - `workspace_id: string or null`1187511876    ID of the Workspace this Tunnel belongs to, or `null` for the default11877    Workspace. Immutable after creation.1187811879- `next_page: string or null`1188011881  Opaque cursor for the next page, or `null` if there are no more results.1188211883#### Example1188411885```bash11886curl https://api.anthropic.com/v1/organizations/tunnels \11887    -H 'anthropic-version: 2023-06-01' \11888    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \11889    -H "X-Api-Key: $ANTHROPIC_API_KEY"11890```1189111892##### Response (200)1189311894```json11895{11896  "data": [11897    {11898      "id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",11899      "archived_at": "2024-11-01T23:59:27.427722Z",11900      "created_at": "2024-10-30T23:58:27.427722Z",11901      "display_name": "Production",11902      "domain": "a1b2c3d4.tunnel.anthropic.com",11903      "type": "tunnel",11904      "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"11905    }11906  ],11907  "next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo="11908}11909```1191011911### Get Tunnel1191211913**GET** `/v1/organizations/tunnels/{tunnel_id}`1191411915**Deprecated**1191611917**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.1191811919Retrieve a single tunnel in the caller's organization by ID.1192011921#### Path parameters1192211923- `tunnel_id: string`1192411925  ID of the Tunnel.1192611927#### Headers1192811929- `"anthropic-beta": array of AnthropicBeta`1193011931  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.1193211933  - `string`1193411935  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`1193611937    - `"message-batches-2024-09-24"`1193811939    - `"prompt-caching-2024-07-31"`1194011941    - `"computer-use-2024-10-22"`1194211943    - `"computer-use-2025-01-24"`1194411945    - `"pdfs-2024-09-25"`1194611947    - `"token-counting-2024-11-01"`1194811949    - `"token-efficient-tools-2025-02-19"`1195011951    - `"output-128k-2025-02-19"`1195211953    - `"files-api-2025-04-14"`1195411955    - `"mcp-client-2025-04-04"`1195611957    - `"mcp-client-2025-11-20"`1195811959    - `"dev-full-thinking-2025-05-14"`1196011961    - `"interleaved-thinking-2025-05-14"`1196211963    - `"code-execution-2025-05-22"`1196411965    - `"extended-cache-ttl-2025-04-11"`1196611967    - `"context-1m-2025-08-07"`1196811969    - `"context-management-2025-06-27"`1197011971    - `"model-context-window-exceeded-2025-08-26"`1197211973    - `"skills-2025-10-02"`1197411975    - `"fast-mode-2026-02-01"`1197611977    - `"output-300k-2026-03-24"`1197811979    - `"user-profiles-2026-03-24"`1198011981    - `"user-profiles-2026-08-18"`1198211983    - `"user-profiles-2026-09-04"`1198411985    - `"advisor-tool-2026-03-01"`1198611987    - `"managed-agents-2026-04-01"`1198811989    - `"cache-diagnosis-2026-04-07"`1199011991    - `"dreaming-2026-04-21"`1199211993    - `"thinking-token-count-2026-05-13"`1199411995    - `"server-side-fallback-2026-06-01"`1199611997    - `"server-side-fallback-2026-07-01"`1199811999    - `"fallback-credit-2026-06-01"`1200012001    - `"fallback-credit-2026-07-01"`1200212003    - `"agent-memory-2026-07-22"`1200412005    - `"mid-conversation-tool-changes-2026-07-01"`1200612007    - `"compact-2026-01-12"`1200812009    - `"computer-use-2025-11-24"`1201012011    - `"mcp-tunnels-2026-06-22"`1201212013    - `"structured-outputs-2025-11-13"`1201412015    - `"task-budgets-2026-03-13"`1201612017    - `"thinking-display-updates-2026-08-18"`1201812019    - `"ce-user-management-2026-07-13"`1202012021    - `"mid-conversation-output-config-2026-07-01"`1202212023    - `"thinking-binding-controls-2026-08-01"`1202412025    - `"mid-conversation-system-clear-at-2026-08-21"`1202612027    - `"compact-2026-09-04"`1202812029#### Returns1203012031- `BetaOrganizationTunnel object`1203212033  - `type: "tunnel"`1203412035    Object type. Always `tunnel` for Tunnels.1203612037    default: tunnel1203812039  - `id: string`1204012041    ID of the Tunnel.1204212043  - `archived_at: string or null`1204412045    RFC 3339 datetime string indicating when the Tunnel was archived, or12046    `null` if it is not archived.1204712048    format: date-time1204912050  - `created_at: string`1205112052    RFC 3339 datetime string indicating when the Tunnel was created.1205312054    format: date-time1205512056  - `display_name: string or null`1205712058    Human-readable name for the Tunnel (1–255 characters), or `null` if unset.1205912060  - `domain: string`1206112062    Anthropic-assigned hostname for the Tunnel. MCP server URLs whose host is a12063    subdomain of this value are routed through the Tunnel. Globally unique and12064    never reused, even after the Tunnel is archived.1206512066  - `workspace_id: string or null`1206712068    ID of the Workspace this Tunnel belongs to, or `null` for the default12069    Workspace. Immutable after creation.1207012071#### Example1207212073```bash12074curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID \12075    -H 'anthropic-version: 2023-06-01' \12076    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \12077    -H "X-Api-Key: $ANTHROPIC_API_KEY"12078```1207912080##### Response (200)1208112082```json12083{12084  "id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",12085  "archived_at": "2024-11-01T23:59:27.427722Z",12086  "created_at": "2024-10-30T23:58:27.427722Z",12087  "display_name": "Production",12088  "domain": "a1b2c3d4.tunnel.anthropic.com",12089  "type": "tunnel",12090  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"12091}12092```1209312094### Archive Tunnel1209512096**POST** `/v1/organizations/tunnels/{tunnel_id}/archive`1209712098**Deprecated**1209912100**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.1210112102Archive a tunnel. Archival is irreversible.1210312104Every non-archived certificate on the tunnel is archived in the same12105operation, the hostname is retired and never re-allocated, and the12106tunnel token is invalidated. Retrying against an already-archived12107tunnel returns the existing record unchanged.1210812109#### Path parameters1211012111- `tunnel_id: string`1211212113  ID of the Tunnel.1211412115#### Headers1211612117- `"anthropic-beta": array of AnthropicBeta`1211812119  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.1212012121  - `string`1212212123  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`1212412125    - `"message-batches-2024-09-24"`1212612127    - `"prompt-caching-2024-07-31"`1212812129    - `"computer-use-2024-10-22"`1213012131    - `"computer-use-2025-01-24"`1213212133    - `"pdfs-2024-09-25"`1213412135    - `"token-counting-2024-11-01"`1213612137    - `"token-efficient-tools-2025-02-19"`1213812139    - `"output-128k-2025-02-19"`1214012141    - `"files-api-2025-04-14"`1214212143    - `"mcp-client-2025-04-04"`1214412145    - `"mcp-client-2025-11-20"`1214612147    - `"dev-full-thinking-2025-05-14"`1214812149    - `"interleaved-thinking-2025-05-14"`1215012151    - `"code-execution-2025-05-22"`1215212153    - `"extended-cache-ttl-2025-04-11"`1215412155    - `"context-1m-2025-08-07"`1215612157    - `"context-management-2025-06-27"`1215812159    - `"model-context-window-exceeded-2025-08-26"`1216012161    - `"skills-2025-10-02"`1216212163    - `"fast-mode-2026-02-01"`1216412165    - `"output-300k-2026-03-24"`1216612167    - `"user-profiles-2026-03-24"`1216812169    - `"user-profiles-2026-08-18"`1217012171    - `"user-profiles-2026-09-04"`1217212173    - `"advisor-tool-2026-03-01"`1217412175    - `"managed-agents-2026-04-01"`1217612177    - `"cache-diagnosis-2026-04-07"`1217812179    - `"dreaming-2026-04-21"`1218012181    - `"thinking-token-count-2026-05-13"`1218212183    - `"server-side-fallback-2026-06-01"`1218412185    - `"server-side-fallback-2026-07-01"`1218612187    - `"fallback-credit-2026-06-01"`1218812189    - `"fallback-credit-2026-07-01"`1219012191    - `"agent-memory-2026-07-22"`1219212193    - `"mid-conversation-tool-changes-2026-07-01"`1219412195    - `"compact-2026-01-12"`1219612197    - `"computer-use-2025-11-24"`1219812199    - `"mcp-tunnels-2026-06-22"`1220012201    - `"structured-outputs-2025-11-13"`1220212203    - `"task-budgets-2026-03-13"`1220412205    - `"thinking-display-updates-2026-08-18"`1220612207    - `"ce-user-management-2026-07-13"`1220812209    - `"mid-conversation-output-config-2026-07-01"`1221012211    - `"thinking-binding-controls-2026-08-01"`1221212213    - `"mid-conversation-system-clear-at-2026-08-21"`1221412215    - `"compact-2026-09-04"`1221612217#### Returns1221812219- `BetaOrganizationTunnel object`1222012221  - `type: "tunnel"`1222212223    Object type. Always `tunnel` for Tunnels.1222412225    default: tunnel1222612227  - `id: string`1222812229    ID of the Tunnel.1223012231  - `archived_at: string or null`1223212233    RFC 3339 datetime string indicating when the Tunnel was archived, or12234    `null` if it is not archived.1223512236    format: date-time1223712238  - `created_at: string`1223912240    RFC 3339 datetime string indicating when the Tunnel was created.1224112242    format: date-time1224312244  - `display_name: string or null`1224512246    Human-readable name for the Tunnel (1–255 characters), or `null` if unset.1224712248  - `domain: string`1224912250    Anthropic-assigned hostname for the Tunnel. MCP server URLs whose host is a12251    subdomain of this value are routed through the Tunnel. Globally unique and12252    never reused, even after the Tunnel is archived.1225312254  - `workspace_id: string or null`1225512256    ID of the Workspace this Tunnel belongs to, or `null` for the default12257    Workspace. Immutable after creation.1225812259#### Example1226012261```bash12262curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/archive \12263    -X POST \12264    -H 'anthropic-version: 2023-06-01' \12265    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \12266    -H "X-Api-Key: $ANTHROPIC_API_KEY"12267```1226812269##### Response (200)1227012271```json12272{12273  "id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",12274  "archived_at": "2024-11-01T23:59:27.427722Z",12275  "created_at": "2024-10-30T23:58:27.427722Z",12276  "display_name": "Production",12277  "domain": "a1b2c3d4.tunnel.anthropic.com",12278  "type": "tunnel",12279  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"12280}12281```1228212283### Reveal Tunnel Token1228412285**POST** `/v1/organizations/tunnels/{tunnel_id}/reveal_token`1228612287**Deprecated**1228812289**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.1229012291Return the tunnel's current connection token.1229212293The value is fetched live on each call; Anthropic does not store it.12294Repeated calls return the same value until the token is rotated.12295Exposed as `POST` so the token does not appear in intermediary12296access logs.1229712298#### Path parameters1229912300- `tunnel_id: string`1230112302  ID of the Tunnel.1230312304#### Headers1230512306- `"anthropic-beta": array of AnthropicBeta`1230712308  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.1230912310  - `string`1231112312  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`1231312314    - `"message-batches-2024-09-24"`1231512316    - `"prompt-caching-2024-07-31"`1231712318    - `"computer-use-2024-10-22"`1231912320    - `"computer-use-2025-01-24"`1232112322    - `"pdfs-2024-09-25"`1232312324    - `"token-counting-2024-11-01"`1232512326    - `"token-efficient-tools-2025-02-19"`1232712328    - `"output-128k-2025-02-19"`1232912330    - `"files-api-2025-04-14"`1233112332    - `"mcp-client-2025-04-04"`1233312334    - `"mcp-client-2025-11-20"`1233512336    - `"dev-full-thinking-2025-05-14"`1233712338    - `"interleaved-thinking-2025-05-14"`1233912340    - `"code-execution-2025-05-22"`1234112342    - `"extended-cache-ttl-2025-04-11"`1234312344    - `"context-1m-2025-08-07"`1234512346    - `"context-management-2025-06-27"`1234712348    - `"model-context-window-exceeded-2025-08-26"`1234912350    - `"skills-2025-10-02"`1235112352    - `"fast-mode-2026-02-01"`1235312354    - `"output-300k-2026-03-24"`1235512356    - `"user-profiles-2026-03-24"`1235712358    - `"user-profiles-2026-08-18"`1235912360    - `"user-profiles-2026-09-04"`1236112362    - `"advisor-tool-2026-03-01"`1236312364    - `"managed-agents-2026-04-01"`1236512366    - `"cache-diagnosis-2026-04-07"`1236712368    - `"dreaming-2026-04-21"`1236912370    - `"thinking-token-count-2026-05-13"`1237112372    - `"server-side-fallback-2026-06-01"`1237312374    - `"server-side-fallback-2026-07-01"`1237512376    - `"fallback-credit-2026-06-01"`1237712378    - `"fallback-credit-2026-07-01"`1237912380    - `"agent-memory-2026-07-22"`1238112382    - `"mid-conversation-tool-changes-2026-07-01"`1238312384    - `"compact-2026-01-12"`1238512386    - `"computer-use-2025-11-24"`1238712388    - `"mcp-tunnels-2026-06-22"`1238912390    - `"structured-outputs-2025-11-13"`1239112392    - `"task-budgets-2026-03-13"`1239312394    - `"thinking-display-updates-2026-08-18"`1239512396    - `"ce-user-management-2026-07-13"`1239712398    - `"mid-conversation-output-config-2026-07-01"`1239912400    - `"thinking-binding-controls-2026-08-01"`1240112402    - `"mid-conversation-system-clear-at-2026-08-21"`1240312404    - `"compact-2026-09-04"`1240512406#### Returns1240712408- `BetaOrganizationTunnelToken object`1240912410  - `type: "tunnel_token"`1241112412    Object type. Always `tunnel_token` for Tunnel Tokens.1241312414    default: tunnel_token1241512416  - `id: string`1241712418    Stable identifier for the current token value. Changes when the token is12419    rotated.1242012421  - `tunnel_token: string`1242212423    The tunnel's connection token.1242412425#### Example1242612427```bash12428curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/reveal_token \12429    -X POST \12430    -H 'anthropic-version: 2023-06-01' \12431    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \12432    -H "X-Api-Key: $ANTHROPIC_API_KEY"12433```1243412435##### Response (200)1243612437```json12438{12439  "id": "ttkn_bb97000eaec162831399ca9b6684a4fdf5be49ace5683057b017aab5c87e19e0",12440  "tunnel_token": "eyJhIjoiRVhBTVBMRSIsInQiOiJFWEFNUExFIiwicyI6IkVYQU1QTEUifQ==",12441  "type": "tunnel_token"12442}12443```1244412445### Rotate Tunnel Token1244612447**POST** `/v1/organizations/tunnels/{tunnel_id}/rotate_token`1244812449**Deprecated**1245012451**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.1245212453Invalidate the tunnel's current token for new connections and return a fresh value.1245412455Established connections are not severed by rotation; a connector12456restarted after rotation must use the new value. An optional12457`reason` is captured for operational context.1245812459#### Path parameters1246012461- `tunnel_id: string`1246212463  ID of the Tunnel.1246412465#### Headers1246612467- `"anthropic-beta": array of AnthropicBeta`1246812469  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.1247012471  - `string`1247212473  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`1247412475    - `"message-batches-2024-09-24"`1247612477    - `"prompt-caching-2024-07-31"`1247812479    - `"computer-use-2024-10-22"`1248012481    - `"computer-use-2025-01-24"`1248212483    - `"pdfs-2024-09-25"`1248412485    - `"token-counting-2024-11-01"`1248612487    - `"token-efficient-tools-2025-02-19"`1248812489    - `"output-128k-2025-02-19"`1249012491    - `"files-api-2025-04-14"`1249212493    - `"mcp-client-2025-04-04"`1249412495    - `"mcp-client-2025-11-20"`1249612497    - `"dev-full-thinking-2025-05-14"`1249812499    - `"interleaved-thinking-2025-05-14"`1250012501    - `"code-execution-2025-05-22"`1250212503    - `"extended-cache-ttl-2025-04-11"`1250412505    - `"context-1m-2025-08-07"`1250612507    - `"context-management-2025-06-27"`1250812509    - `"model-context-window-exceeded-2025-08-26"`1251012511    - `"skills-2025-10-02"`1251212513    - `"fast-mode-2026-02-01"`1251412515    - `"output-300k-2026-03-24"`1251612517    - `"user-profiles-2026-03-24"`1251812519    - `"user-profiles-2026-08-18"`1252012521    - `"user-profiles-2026-09-04"`1252212523    - `"advisor-tool-2026-03-01"`1252412525    - `"managed-agents-2026-04-01"`1252612527    - `"cache-diagnosis-2026-04-07"`1252812529    - `"dreaming-2026-04-21"`1253012531    - `"thinking-token-count-2026-05-13"`1253212533    - `"server-side-fallback-2026-06-01"`1253412535    - `"server-side-fallback-2026-07-01"`1253612537    - `"fallback-credit-2026-06-01"`1253812539    - `"fallback-credit-2026-07-01"`1254012541    - `"agent-memory-2026-07-22"`1254212543    - `"mid-conversation-tool-changes-2026-07-01"`1254412545    - `"compact-2026-01-12"`1254612547    - `"computer-use-2025-11-24"`1254812549    - `"mcp-tunnels-2026-06-22"`1255012551    - `"structured-outputs-2025-11-13"`1255212553    - `"task-budgets-2026-03-13"`1255412555    - `"thinking-display-updates-2026-08-18"`1255612557    - `"ce-user-management-2026-07-13"`1255812559    - `"mid-conversation-output-config-2026-07-01"`1256012561    - `"thinking-binding-controls-2026-08-01"`1256212563    - `"mid-conversation-system-clear-at-2026-08-21"`1256412565    - `"compact-2026-09-04"`1256612567#### Body parameters1256812569- `reason: optional string or null`1257012571  Optional free-text reason for the rotation, recorded for audit.1257212573  maxLength: 10241257412575#### Returns1257612577- `BetaOrganizationTunnelToken object`1257812579  - `type: "tunnel_token"`1258012581    Object type. Always `tunnel_token` for Tunnel Tokens.1258212583    default: tunnel_token1258412585  - `id: string`1258612587    Stable identifier for the current token value. Changes when the token is12588    rotated.1258912590  - `tunnel_token: string`1259112592    The tunnel's connection token.1259312594#### Example1259512596```bash12597curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/rotate_token \12598    -X POST \12599    -H 'anthropic-version: 2023-06-01' \12600    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \12601    -H "X-Api-Key: $ANTHROPIC_API_KEY"12602```1260312604##### Response (200)1260512606```json12607{12608  "id": "ttkn_bb97000eaec162831399ca9b6684a4fdf5be49ace5683057b017aab5c87e19e0",12609  "tunnel_token": "eyJhIjoiRVhBTVBMRSIsInQiOiJFWEFNUExFIiwicyI6IkVYQU1QTEUifQ==",12610  "type": "tunnel_token"12611}12612```1261312614## Organization › MCP Tunnels › Tunnel Certificates1261512616### Create Tunnel Certificate1261712618**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates`1261912620**Deprecated**1262112622**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.1262312624Register a public CA certificate for the tunnel.1262512626Anthropic verifies the gateway's server certificate against this CA12627when it terminates the inner TLS session. The PEM body must contain12628exactly one X.509 certificate and no private-key material. A tunnel12629holds at most two non-archived certificates.1263012631#### Path parameters1263212633- `tunnel_id: string`1263412635  ID of the Tunnel.1263612637#### Headers1263812639- `"anthropic-beta": array of AnthropicBeta`1264012641  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.1264212643  - `string`1264412645  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`1264612647    - `"message-batches-2024-09-24"`1264812649    - `"prompt-caching-2024-07-31"`1265012651    - `"computer-use-2024-10-22"`1265212653    - `"computer-use-2025-01-24"`1265412655    - `"pdfs-2024-09-25"`1265612657    - `"token-counting-2024-11-01"`1265812659    - `"token-efficient-tools-2025-02-19"`1266012661    - `"output-128k-2025-02-19"`1266212663    - `"files-api-2025-04-14"`1266412665    - `"mcp-client-2025-04-04"`1266612667    - `"mcp-client-2025-11-20"`1266812669    - `"dev-full-thinking-2025-05-14"`1267012671    - `"interleaved-thinking-2025-05-14"`1267212673    - `"code-execution-2025-05-22"`1267412675    - `"extended-cache-ttl-2025-04-11"`1267612677    - `"context-1m-2025-08-07"`1267812679    - `"context-management-2025-06-27"`1268012681    - `"model-context-window-exceeded-2025-08-26"`1268212683    - `"skills-2025-10-02"`1268412685    - `"fast-mode-2026-02-01"`1268612687    - `"output-300k-2026-03-24"`1268812689    - `"user-profiles-2026-03-24"`1269012691    - `"user-profiles-2026-08-18"`1269212693    - `"user-profiles-2026-09-04"`1269412695    - `"advisor-tool-2026-03-01"`1269612697    - `"managed-agents-2026-04-01"`1269812699    - `"cache-diagnosis-2026-04-07"`1270012701    - `"dreaming-2026-04-21"`1270212703    - `"thinking-token-count-2026-05-13"`1270412705    - `"server-side-fallback-2026-06-01"`1270612707    - `"server-side-fallback-2026-07-01"`1270812709    - `"fallback-credit-2026-06-01"`1271012711    - `"fallback-credit-2026-07-01"`1271212713    - `"agent-memory-2026-07-22"`1271412715    - `"mid-conversation-tool-changes-2026-07-01"`1271612717    - `"compact-2026-01-12"`1271812719    - `"computer-use-2025-11-24"`1272012721    - `"mcp-tunnels-2026-06-22"`1272212723    - `"structured-outputs-2025-11-13"`1272412725    - `"task-budgets-2026-03-13"`1272612727    - `"thinking-display-updates-2026-08-18"`1272812729    - `"ce-user-management-2026-07-13"`1273012731    - `"mid-conversation-output-config-2026-07-01"`1273212733    - `"thinking-binding-controls-2026-08-01"`1273412735    - `"mid-conversation-system-clear-at-2026-08-21"`1273612737    - `"compact-2026-09-04"`1273812739#### Body parameters1274012741- `ca_certificate_pem: string`1274212743  PEM-encoded X.509 CA certificate. Must contain exactly one certificate and12744  no private-key material.1274512746  maxLength: 81921274712748#### Returns1274912750- `BetaOrganizationTunnelCertificate object`1275112752  - `type: "tunnel_certificate"`1275312754    Object type. Always `tunnel_certificate` for Tunnel Certificates.1275512756    default: tunnel_certificate1275712758  - `id: string`1275912760    ID of the Tunnel Certificate.1276112762  - `archived_at: string or null`1276312764    RFC 3339 datetime string indicating when the certificate was archived, or12765    `null` if it is not archived.1276612767    format: date-time1276812769  - `created_at: string`1277012771    RFC 3339 datetime string indicating when the certificate was registered.1277212773    format: date-time1277412775  - `expires_at: string or null`1277612777    RFC 3339 datetime string indicating when the certificate expires, or12778    `null` if it does not expire.1277912780    format: date-time1278112782  - `fingerprint: string`1278312784    The certificate's SHA-256 fingerprint, as a lowercase hex string.1278512786  - `tunnel_id: string`1278712788    ID of the Tunnel this certificate is registered against.1278912790#### Example1279112792```bash12793curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \12794    -H 'Content-Type: application/json' \12795    -H 'anthropic-version: 2023-06-01' \12796    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \12797    -H "X-Api-Key: $ANTHROPIC_API_KEY" \12798    -d '{12799          "ca_certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIBexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexampleEXAMPLEexa\n...illustrative placeholder, not a real certificate...\n-----END CERTIFICATE-----\n"12800        }'12801```1280212803##### Response (200)1280412805```json12806{12807  "id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",12808  "archived_at": "2024-11-01T23:59:27.427722Z",12809  "created_at": "2024-10-30T23:58:27.427722Z",12810  "expires_at": "2024-10-30T23:58:27.427722Z",12811  "fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",12812  "tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",12813  "type": "tunnel_certificate"12814}12815```1281612817### List Tunnel Certificates1281812819**GET** `/v1/organizations/tunnels/{tunnel_id}/certificates`1282012821**Deprecated**1282212823**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.1282412825List the certificates registered on a tunnel.1282612827Archived certificates are excluded unless `include_archived` is set.1282812829#### Path parameters1283012831- `tunnel_id: string`1283212833  ID of the Tunnel.1283412835#### Query parameters1283612837- `include_archived: optional boolean`1283812839  Include archived certificates in the results. Archived certificates are12840  excluded by default.1284112842  default: false1284312844- `limit: optional number`1284512846  Maximum number of certificates to return.1284712848  default: 20, maximum: 1000, minimum: 11284912850- `page: optional string`1285112852  A tunnel has at most two active certificates, so this list is not12853  paginated.1285412855#### Headers1285612857- `"anthropic-beta": array of AnthropicBeta`1285812859  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.1286012861  - `string`1286212863  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`1286412865    - `"message-batches-2024-09-24"`1286612867    - `"prompt-caching-2024-07-31"`1286812869    - `"computer-use-2024-10-22"`1287012871    - `"computer-use-2025-01-24"`1287212873    - `"pdfs-2024-09-25"`1287412875    - `"token-counting-2024-11-01"`1287612877    - `"token-efficient-tools-2025-02-19"`1287812879    - `"output-128k-2025-02-19"`1288012881    - `"files-api-2025-04-14"`1288212883    - `"mcp-client-2025-04-04"`1288412885    - `"mcp-client-2025-11-20"`1288612887    - `"dev-full-thinking-2025-05-14"`1288812889    - `"interleaved-thinking-2025-05-14"`1289012891    - `"code-execution-2025-05-22"`1289212893    - `"extended-cache-ttl-2025-04-11"`1289412895    - `"context-1m-2025-08-07"`1289612897    - `"context-management-2025-06-27"`1289812899    - `"model-context-window-exceeded-2025-08-26"`1290012901    - `"skills-2025-10-02"`1290212903    - `"fast-mode-2026-02-01"`1290412905    - `"output-300k-2026-03-24"`1290612907    - `"user-profiles-2026-03-24"`1290812909    - `"user-profiles-2026-08-18"`1291012911    - `"user-profiles-2026-09-04"`1291212913    - `"advisor-tool-2026-03-01"`1291412915    - `"managed-agents-2026-04-01"`1291612917    - `"cache-diagnosis-2026-04-07"`1291812919    - `"dreaming-2026-04-21"`1292012921    - `"thinking-token-count-2026-05-13"`1292212923    - `"server-side-fallback-2026-06-01"`1292412925    - `"server-side-fallback-2026-07-01"`1292612927    - `"fallback-credit-2026-06-01"`1292812929    - `"fallback-credit-2026-07-01"`1293012931    - `"agent-memory-2026-07-22"`1293212933    - `"mid-conversation-tool-changes-2026-07-01"`1293412935    - `"compact-2026-01-12"`1293612937    - `"computer-use-2025-11-24"`1293812939    - `"mcp-tunnels-2026-06-22"`1294012941    - `"structured-outputs-2025-11-13"`1294212943    - `"task-budgets-2026-03-13"`1294412945    - `"thinking-display-updates-2026-08-18"`1294612947    - `"ce-user-management-2026-07-13"`1294812949    - `"mid-conversation-output-config-2026-07-01"`1295012951    - `"thinking-binding-controls-2026-08-01"`1295212953    - `"mid-conversation-system-clear-at-2026-08-21"`1295412955    - `"compact-2026-09-04"`1295612957#### Returns1295812959- `data: array of BetaOrganizationTunnelCertificate`1296012961  - `type: "tunnel_certificate"`1296212963    Object type. Always `tunnel_certificate` for Tunnel Certificates.1296412965    default: tunnel_certificate1296612967  - `id: string`1296812969    ID of the Tunnel Certificate.1297012971  - `archived_at: string or null`1297212973    RFC 3339 datetime string indicating when the certificate was archived, or12974    `null` if it is not archived.1297512976    format: date-time1297712978  - `created_at: string`1297912980    RFC 3339 datetime string indicating when the certificate was registered.1298112982    format: date-time1298312984  - `expires_at: string or null`1298512986    RFC 3339 datetime string indicating when the certificate expires, or12987    `null` if it does not expire.1298812989    format: date-time1299012991  - `fingerprint: string`1299212993    The certificate's SHA-256 fingerprint, as a lowercase hex string.1299412995  - `tunnel_id: string`1299612997    ID of the Tunnel this certificate is registered against.1299812999- `next_page: string or null`1300013001  Opaque cursor for the next page, or `null` if there are no more results.1300213003#### Example1300413005```bash13006curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates \13007    -H 'anthropic-version: 2023-06-01' \13008    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \13009    -H "X-Api-Key: $ANTHROPIC_API_KEY"13010```1301113012##### Response (200)1301313014```json13015{13016  "data": [13017    {13018      "id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",13019      "archived_at": "2024-11-01T23:59:27.427722Z",13020      "created_at": "2024-10-30T23:58:27.427722Z",13021      "expires_at": "2024-10-30T23:58:27.427722Z",13022      "fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",13023      "tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",13024      "type": "tunnel_certificate"13025    }13026  ],13027  "next_page": "page_MjAyNS0wNS0xNFQwMDowMDowMFo="13028}13029```1303013031### Get Tunnel Certificate1303213033**GET** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}`1303413035**Deprecated**1303613037**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.1303813039Retrieve a single certificate registered on a tunnel by ID.1304013041#### Path parameters1304213043- `tunnel_id: string`1304413045  ID of the Tunnel.1304613047- `certificate_id: string`1304813049  ID of the Tunnel Certificate.1305013051#### Headers1305213053- `"anthropic-beta": array of AnthropicBeta`1305413055  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.1305613057  - `string`1305813059  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`1306013061    - `"message-batches-2024-09-24"`1306213063    - `"prompt-caching-2024-07-31"`1306413065    - `"computer-use-2024-10-22"`1306613067    - `"computer-use-2025-01-24"`1306813069    - `"pdfs-2024-09-25"`1307013071    - `"token-counting-2024-11-01"`1307213073    - `"token-efficient-tools-2025-02-19"`1307413075    - `"output-128k-2025-02-19"`1307613077    - `"files-api-2025-04-14"`1307813079    - `"mcp-client-2025-04-04"`1308013081    - `"mcp-client-2025-11-20"`1308213083    - `"dev-full-thinking-2025-05-14"`1308413085    - `"interleaved-thinking-2025-05-14"`1308613087    - `"code-execution-2025-05-22"`1308813089    - `"extended-cache-ttl-2025-04-11"`1309013091    - `"context-1m-2025-08-07"`1309213093    - `"context-management-2025-06-27"`1309413095    - `"model-context-window-exceeded-2025-08-26"`1309613097    - `"skills-2025-10-02"`1309813099    - `"fast-mode-2026-02-01"`1310013101    - `"output-300k-2026-03-24"`1310213103    - `"user-profiles-2026-03-24"`1310413105    - `"user-profiles-2026-08-18"`1310613107    - `"user-profiles-2026-09-04"`1310813109    - `"advisor-tool-2026-03-01"`1311013111    - `"managed-agents-2026-04-01"`1311213113    - `"cache-diagnosis-2026-04-07"`1311413115    - `"dreaming-2026-04-21"`1311613117    - `"thinking-token-count-2026-05-13"`1311813119    - `"server-side-fallback-2026-06-01"`1312013121    - `"server-side-fallback-2026-07-01"`1312213123    - `"fallback-credit-2026-06-01"`1312413125    - `"fallback-credit-2026-07-01"`1312613127    - `"agent-memory-2026-07-22"`1312813129    - `"mid-conversation-tool-changes-2026-07-01"`1313013131    - `"compact-2026-01-12"`1313213133    - `"computer-use-2025-11-24"`1313413135    - `"mcp-tunnels-2026-06-22"`1313613137    - `"structured-outputs-2025-11-13"`1313813139    - `"task-budgets-2026-03-13"`1314013141    - `"thinking-display-updates-2026-08-18"`1314213143    - `"ce-user-management-2026-07-13"`1314413145    - `"mid-conversation-output-config-2026-07-01"`1314613147    - `"thinking-binding-controls-2026-08-01"`1314813149    - `"mid-conversation-system-clear-at-2026-08-21"`1315013151    - `"compact-2026-09-04"`1315213153#### Returns1315413155- `BetaOrganizationTunnelCertificate object`1315613157  - `type: "tunnel_certificate"`1315813159    Object type. Always `tunnel_certificate` for Tunnel Certificates.1316013161    default: tunnel_certificate1316213163  - `id: string`1316413165    ID of the Tunnel Certificate.1316613167  - `archived_at: string or null`1316813169    RFC 3339 datetime string indicating when the certificate was archived, or13170    `null` if it is not archived.1317113172    format: date-time1317313174  - `created_at: string`1317513176    RFC 3339 datetime string indicating when the certificate was registered.1317713178    format: date-time1317913180  - `expires_at: string or null`1318113182    RFC 3339 datetime string indicating when the certificate expires, or13183    `null` if it does not expire.1318413185    format: date-time1318613187  - `fingerprint: string`1318813189    The certificate's SHA-256 fingerprint, as a lowercase hex string.1319013191  - `tunnel_id: string`1319213193    ID of the Tunnel this certificate is registered against.1319413195#### Example1319613197```bash13198curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID \13199    -H 'anthropic-version: 2023-06-01' \13200    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \13201    -H "X-Api-Key: $ANTHROPIC_API_KEY"13202```1320313204##### Response (200)1320513206```json13207{13208  "id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",13209  "archived_at": "2024-11-01T23:59:27.427722Z",13210  "created_at": "2024-10-30T23:58:27.427722Z",13211  "expires_at": "2024-10-30T23:58:27.427722Z",13212  "fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",13213  "tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",13214  "type": "tunnel_certificate"13215}13216```1321713218### Archive Tunnel Certificate1321913220**POST** `/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive`1322113222**Deprecated**1322313224**Deprecated.** This Admin API endpoint is superseded by `/v1/tunnels` on the Claude API and will be removed after a migration window. New integrations should use [`/v1/tunnels`](/docs/en/api/beta/tunnels) with the `anthropic-beta: mcp-tunnels-2026-06-22` header and a WIF token carrying the `workspace:manage_tunnels` scope. Existing integrations continue to work with the `mcp-tunnels-2026-05-19` header and `org:manage_tunnels` scope during the migration window.1322513226Archive a certificate, removing it from the set Anthropic trusts for this tunnel.1322713228The certificate record is retained. Archiving the last non-archived13229certificate is permitted; the tunnel rejects MCP traffic until a new13230certificate is added.1323113232#### Path parameters1323313234- `tunnel_id: string`1323513236  ID of the Tunnel.1323713238- `certificate_id: string`1323913240  ID of the Tunnel Certificate.1324113242#### Headers1324313244- `"anthropic-beta": array of AnthropicBeta`1324513246  This endpoint is in beta: requests must send `mcp-tunnels-2026-05-19` in this header.1324713248  - `string`1324913250  - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`1325113252    - `"message-batches-2024-09-24"`1325313254    - `"prompt-caching-2024-07-31"`1325513256    - `"computer-use-2024-10-22"`1325713258    - `"computer-use-2025-01-24"`1325913260    - `"pdfs-2024-09-25"`1326113262    - `"token-counting-2024-11-01"`1326313264    - `"token-efficient-tools-2025-02-19"`1326513266    - `"output-128k-2025-02-19"`1326713268    - `"files-api-2025-04-14"`1326913270    - `"mcp-client-2025-04-04"`1327113272    - `"mcp-client-2025-11-20"`1327313274    - `"dev-full-thinking-2025-05-14"`1327513276    - `"interleaved-thinking-2025-05-14"`1327713278    - `"code-execution-2025-05-22"`1327913280    - `"extended-cache-ttl-2025-04-11"`1328113282    - `"context-1m-2025-08-07"`1328313284    - `"context-management-2025-06-27"`1328513286    - `"model-context-window-exceeded-2025-08-26"`1328713288    - `"skills-2025-10-02"`1328913290    - `"fast-mode-2026-02-01"`1329113292    - `"output-300k-2026-03-24"`1329313294    - `"user-profiles-2026-03-24"`1329513296    - `"user-profiles-2026-08-18"`1329713298    - `"user-profiles-2026-09-04"`1329913300    - `"advisor-tool-2026-03-01"`1330113302    - `"managed-agents-2026-04-01"`1330313304    - `"cache-diagnosis-2026-04-07"`1330513306    - `"dreaming-2026-04-21"`1330713308    - `"thinking-token-count-2026-05-13"`1330913310    - `"server-side-fallback-2026-06-01"`1331113312    - `"server-side-fallback-2026-07-01"`1331313314    - `"fallback-credit-2026-06-01"`1331513316    - `"fallback-credit-2026-07-01"`1331713318    - `"agent-memory-2026-07-22"`1331913320    - `"mid-conversation-tool-changes-2026-07-01"`1332113322    - `"compact-2026-01-12"`1332313324    - `"computer-use-2025-11-24"`1332513326    - `"mcp-tunnels-2026-06-22"`1332713328    - `"structured-outputs-2025-11-13"`1332913330    - `"task-budgets-2026-03-13"`1333113332    - `"thinking-display-updates-2026-08-18"`1333313334    - `"ce-user-management-2026-07-13"`1333513336    - `"mid-conversation-output-config-2026-07-01"`1333713338    - `"thinking-binding-controls-2026-08-01"`1333913340    - `"mid-conversation-system-clear-at-2026-08-21"`1334113342    - `"compact-2026-09-04"`1334313344#### Returns1334513346- `BetaOrganizationTunnelCertificate object`1334713348  - `type: "tunnel_certificate"`1334913350    Object type. Always `tunnel_certificate` for Tunnel Certificates.1335113352    default: tunnel_certificate1335313354  - `id: string`1335513356    ID of the Tunnel Certificate.1335713358  - `archived_at: string or null`1335913360    RFC 3339 datetime string indicating when the certificate was archived, or13361    `null` if it is not archived.1336213363    format: date-time1336413365  - `created_at: string`1336613367    RFC 3339 datetime string indicating when the certificate was registered.1336813369    format: date-time1337013371  - `expires_at: string or null`1337213373    RFC 3339 datetime string indicating when the certificate expires, or13374    `null` if it does not expire.1337513376    format: date-time1337713378  - `fingerprint: string`1337913380    The certificate's SHA-256 fingerprint, as a lowercase hex string.1338113382  - `tunnel_id: string`1338313384    ID of the Tunnel this certificate is registered against.1338513386#### Example1338713388```bash13389curl https://api.anthropic.com/v1/organizations/tunnels/$TUNNEL_ID/certificates/$CERTIFICATE_ID/archive \13390    -X POST \13391    -H 'anthropic-version: 2023-06-01' \13392    -H 'anthropic-beta: mcp-tunnels-2026-05-19' \13393    -H "X-Api-Key: $ANTHROPIC_API_KEY"13394```1339513396##### Response (200)1339713398```json13399{13400  "id": "tcrt_01JmWq4ZxnBvR7tKpY2sLdH9",13401  "archived_at": "2024-11-01T23:59:27.427722Z",13402  "created_at": "2024-10-30T23:58:27.427722Z",13403  "expires_at": "2024-10-30T23:58:27.427722Z",13404  "fingerprint": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",13405  "tunnel_id": "tnl_01Hx9Kp2RtQvMn3sWbYdLcF8",13406  "type": "tunnel_certificate"13407}13408```1340913410## Organization › Analytics1341113412### Get Activity Summaries1341313414**GET** `/v1/organizations/analytics/summaries`1341513416Get organization-wide activity summaries for a date range.1341713418Returns one entry per day from `starting_date` (inclusive) to `ending_date`13419(exclusive). Data is typically available with a 1-day lag and may be13420revised by a few percent over the following days: when `ending_date` is13421omitted it defaults to the most recent available day + 1, so the last13422entry covers the most recent available day. The series can be scoped to13423an RBAC group via `filter[]=rbac_group_id:{id}`. Available to13424organizations on a Claude Enterprise plan. Requires an API key with the13425`read:analytics` scope.1342613427#### Query parameters1342813429- `starting_date: string`1343013431  UTC date in YYYY-MM-DD format. Start of the date range (inclusive). Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.1343213433  format: date1343413435- `ending_date: optional string`1343613437  UTC date in YYYY-MM-DD format. End of the date range (exclusive). Data is typically available with a 1-day lag, so this can be at most today — which is also the default when omitted, making the last entry cover the most recent available day. Data may be revised by a few percent over the following days. The range may span at most 366 days.1343813439  format: date1344013441- `filter: optional array of string`1344213443  Filters as `dimension:value`. Only `rbac_group_id` is supported (e.g. `filter[]=rbac_group_id:{id}`); repeat the param to OR across groups. Scopes the whole day series to members of the matching group(s), re-aggregated from member-level activity — org-wide seat/invite fields and the adoption rates derived from them are null on scoped rows. `rbac_group_id` accepts the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each UTC day (time-of-usage attribution). At most 100 entries.1344413445  maxItems: 1001344613447#### Returns1344813449- `BetaActivitySummary object`1345013451  Response for GET /v1/organizations/analytics/summaries.1345213453  - `summaries: array of object`1345413455    - `assigned_seat_count: number or null`1345613457      Number of seats currently assigned to members. Null when the response is scoped to an RBAC group — seat assignment is org-wide and has no per-group analogue.1345813459    - `cowork_daily_active_user_count: number`1346013461      Number of users with Cowork activity on the requested day1346213463    - `cowork_monthly_active_user_count: number`1346413465      Number of users with Cowork activity in the 30-day rolling window1346613467    - `cowork_weekly_active_user_count: number`1346813469      Number of users with Cowork activity in the 7-day rolling window1347013471    - `daily_active_user_count: number`1347213473      Number of users with token consumption on the requested day1347413475    - `daily_adoption_rate: number or null`1347613477      Percentage of assigned seats with activity on the requested day (`DAU / assigned_seat_count * 100`). Null when the response is scoped to an RBAC group.1347813479    - `ending_at: string`1348013481      End of the aggregation period (exclusive), UTC midnight in RFC 3339 format (e.g. `2026-01-16T00:00:00Z`).1348213483      format: date-time1348413485    - `monthly_active_user_count: number`1348613487      Number of users with token consumption in the 30-day rolling window1348813489    - `monthly_adoption_rate: number or null`1349013491      Percentage of assigned seats with activity in the 30-day rolling window (`MAU / assigned_seat_count * 100`). Null when the response is scoped to an RBAC group.1349213493    - `pending_invite_count: number or null`1349413495      Number of pending invitations to join the organization. Null when the response is scoped to an RBAC group.1349613497    - `starting_at: string`1349813499      Start of the aggregation period (inclusive), UTC midnight in RFC 3339 format (e.g. `2026-01-15T00:00:00Z`).1350013501      format: date-time1350213503    - `weekly_active_user_count: number`1350413505      Number of users with token consumption in the 7-day rolling window1350613507    - `weekly_adoption_rate: number or null`1350813509      Percentage of assigned seats with activity in the 7-day rolling window (`WAU / assigned_seat_count * 100`). Null when the response is scoped to an RBAC group.1351013511    - `chat_daily_active_user_count: optional number or null`1351213513      Number of users with claude.ai (chat) activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization.1351413515    - `chat_monthly_active_user_count: optional number or null`1351613517      Number of users with claude.ai (chat) activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.1351813519    - `chat_weekly_active_user_count: optional number or null`1352013521      Number of users with claude.ai (chat) activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.1352213523    - `claude_code_daily_active_user_count: optional number or null`1352413525      Number of users with Claude Code activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization.1352613527    - `claude_code_monthly_active_user_count: optional number or null`1352813529      Number of users with Claude Code activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.1353013531    - `claude_code_weekly_active_user_count: optional number or null`1353213533      Number of users with Claude Code activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.1353413535    - `claude_design_daily_active_user_count: optional number or null`1353613537      Number of users with Claude Design activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization.1353813539    - `claude_design_monthly_active_user_count: optional number or null`1354013541      Number of users with Claude Design activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.1354213543    - `claude_design_weekly_active_user_count: optional number or null`1354413545      Number of users with Claude Design activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.1354613547    - `office_agent_daily_active_user_count: optional number or null`1354813549      Number of users with Claude in Office activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization.1355013551    - `office_agent_monthly_active_user_count: optional number or null`1355213553      Number of users with Claude in Office activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.1355413555    - `office_agent_weekly_active_user_count: optional number or null`1355613557      Number of users with Claude in Office activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.1355813559    - `science_daily_active_user_count: optional number or null`1356013561      Number of users with Claude Science activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization.1356213563    - `science_entitled_user_count: optional number or null`1356413565      Number of users with a Claude Science seat entitlement (per-seat RBAC) at the time of the daily snapshot. The funnel top; independent of the org-level Claude Science toggle. Null when the response is scoped to an RBAC group — entitlement is org-wide and has no per-group analogue. Omitted from the response while the per-product breakdown is not enabled for this organization.1356613567    - `science_monthly_active_user_count: optional number or null`1356813569      Number of users with Claude Science activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.1357013571    - `science_weekly_active_user_count: optional number or null`1357213573      Number of users with Claude Science activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.1357413575#### Example1357613577```bash13578curl https://api.anthropic.com/v1/organizations/analytics/summaries \13579    -H 'anthropic-version: 2023-06-01' \13580    -H "X-Api-Key: $ANTHROPIC_API_KEY"13581```1358213583##### Response (200)1358413585```json13586{13587  "summaries": [13588    {13589      "assigned_seat_count": 0,13590      "cowork_daily_active_user_count": 0,13591      "cowork_monthly_active_user_count": 0,13592      "cowork_weekly_active_user_count": 0,13593      "daily_active_user_count": 0,13594      "daily_adoption_rate": 0,13595      "ending_at": "2019-12-27T18:11:19.117Z",13596      "monthly_active_user_count": 0,13597      "monthly_adoption_rate": 0,13598      "pending_invite_count": 0,13599      "starting_at": "2019-12-27T18:11:19.117Z",13600      "weekly_active_user_count": 0,13601      "weekly_adoption_rate": 0,13602      "chat_daily_active_user_count": 0,13603      "chat_monthly_active_user_count": 0,13604      "chat_weekly_active_user_count": 0,13605      "claude_code_daily_active_user_count": 0,13606      "claude_code_monthly_active_user_count": 0,13607      "claude_code_weekly_active_user_count": 0,13608      "claude_design_daily_active_user_count": 0,13609      "claude_design_monthly_active_user_count": 0,13610      "claude_design_weekly_active_user_count": 0,13611      "office_agent_daily_active_user_count": 0,13612      "office_agent_monthly_active_user_count": 0,13613      "office_agent_weekly_active_user_count": 0,13614      "science_daily_active_user_count": 0,13615      "science_entitled_user_count": 0,13616      "science_monthly_active_user_count": 0,13617      "science_weekly_active_user_count": 013618    }13619  ]13620}13621```1362213623## Organization › Analytics › Usage1362413625### Get Token Usage Over Time1362613627**GET** `/v1/organizations/analytics/usage_report`1362813629Get token usage over time across a date range.1363013631Returns token usage bucketed by minute, hour, or day, optionally broken13632down by product, model, context window, inference region, or speed.13633Available to organizations on a Claude Enterprise plan. Requires an API13634key with the `read:analytics` scope.1363513636#### Query parameters1363713638- `starting_at: string`1363913640  Start of range, inclusive. RFC 3339 tz-aware. Must be within the last 365 days and no earlier than 2026-01-01T00:00:00Z.1364113642  format: date-time1364313644- `bucket_width: optional "1d" or "1h" or "1m"`1364513646  Time bucket granularity.1364713648  default: 1d1364913650  - `"1d"`1365113652  - `"1h"`1365313654  - `"1m"`1365513656- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`1365713658  Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.1365913660  maxItems: 1001366113662  - `"dm"`1366313664  - `"engaged"`1366513666  - `"monitoring"`1366713668  - `"proactive"`1366913670  - `"scheduled"`1367113672- `claude_tag_user_ids: optional array of string`1367313674  Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.1367513676  maxItems: 1001367713678- `context_windows: optional array of "0-200k" or "200k-1M"`1367913680  Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.1368113682  maxItems: 1001368313684  - `"0-200k"`1368513686  - `"200k-1M"`1368713688- `ending_at: optional string`1368913690  End of range, exclusive. When omitted, defaults to the earlier of now and `starting_at` + 31 days. The range may span at most 31 days.1369113692  format: date-time1369313694- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 6 more`1369513696  Dimensions to break each time bucket out by. Defaults to no grouping (one total per bucket). Each bucket reports at most its top 100 groups; a group beyond that cap has no row in that bucket (there is no remainder row), so grouped buckets are not exhaustive when a dimension has more than 100 distinct values.1369713698  maxItems: 1001369913700  - `"claude_tag_category"`1370113702  - `"claude_tag_user_id"`1370313704  - `"context_window"`1370513706  - `"inference_geo"`1370713708  - `"model"`1370913710  - `"product"`1371113712  - `"rbac_group_id"`1371313714  - `"slack_channel_id"`1371513716  - `"speed"`1371713718- `inference_geos: optional array of "global" or "not_available" or "us"`1371913720  Filter to specific inference regions. `not_available` matches rows where the region is unset. Use `group_by[]=inference_geo` to break out per-region values.1372113722  maxItems: 1001372313724  - `"global"`1372513726  - `"not_available"`1372713728  - `"us"`1372913730- `limit: optional number`1373113732  Maximum number of time buckets per page. Defaults and caps vary by `bucket_width` (`1d`: default 7, max 31; `1h`: default 24, max 168; `1m`: default 60, max 256).1373313734  minimum: 11373513736- `models: optional array of string`1373713738  Models to include. Defaults to all models. Use `group_by[]=model` to break out per-model values.1373913740  maxItems: 1001374113742- `page: optional string`1374313744  Opaque cursor from a previous response's `next_page` field.1374513746- `products: optional array of "chat" or "claude-tag" or "claude_code" or 4 more`1374713748  Product surfaces to include. Defaults to all products. Use `group_by[]=product` to break out per-product values.1374913750  maxItems: 1001375113752  - `"chat"`1375313754  - `"claude-tag"`1375513756  - `"claude_code"`1375713758  - `"claude_design"`1375913760  - `"claude_in_chrome"`1376113762  - `"cowork"`1376313764  - `"office_agent"`1376513766- `rbac_group_ids: optional array of string`1376713768  Filter to usage attributed to specific RBAC groups. Accepts tagged RBAC group IDs (`rbac_group_...`) or bare group UUIDs. A row matches when the user belonged to any of the listed groups on the (UTC) day the usage occurred; usage with no group attribution never matches.1376913770  maxItems: 1001377113772- `slack_channel_ids: optional array of string`1377313774  Filter to usage originating from specific Slack channels. Use `group_by[]=slack_channel_id` to break out per-channel values.1377513776  maxItems: 1001377713778- `speeds: optional array of "fast" or "standard"`1377913780  Filter to fast or standard inference mode. Use `group_by[]=speed` to break out per-mode values.1378113782  maxItems: 1001378313784  - `"fast"`1378513786  - `"standard"`1378713788- `user_ids: optional array of string`1378913790  Filter to specific users by tagged user ID.1379113792  maxItems: 1001379313794#### Returns1379513796- `BetaUsageBucket object`1379713798  - `data: array of object`1379913800    Time buckets for this page, oldest first: one per `bucket_width` interval, including intervals with no data (their `results` list is empty). A page holds at most `limit` buckets.1380113802    - `ending_at: string`1380313804      End of the time bucket (exclusive) in RFC 3339 format.1380513806      format: date-time1380713808    - `results: array of object`1380913810      Rows for this time bucket. Empty when the bucket has no data; otherwise a single combined row when `group_by[]` is omitted, or one row per group (subject to the per-bucket group cap described on the `group_by[]` parameter).1381113812      - `cache_creation: BetaCacheCreation`1381313814        The number of input tokens for cache creation.1381513816        - `ephemeral_1h_input_tokens: number`1381713818          The number of input tokens used to create the 1 hour cache entry.1381913820          default: 0, minimum: 01382113822        - `ephemeral_5m_input_tokens: number`1382313824          The number of input tokens used to create the 5 minute cache entry.1382513826          default: 0, minimum: 01382713828      - `cache_read_input_tokens: number`1382913830        The number of input tokens read from the cache.1383113832      - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`1383313834        Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.1383513836        - `"dm"`1383713838        - `"engaged"`1383913840        - `"monitoring"`1384113842        - `"proactive"`1384313844        - `"scheduled"`1384513846      - `claude_tag_user_id: string or null`1384713848        Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.1384913850      - `context_window: "0-200k" or "200k-1M" or null`1385113852        Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.1385313854        - `"0-200k"`1385513856        - `"200k-1M"`1385713858      - `inference_geo: "global" or "us" or null`1385913860        Inference region of the usage or cost. Null unless `inference_geo` is in `group_by[]`; it can also be null on grouped rows where the region is not set (the rows that `inference_geos[]=not_available` matches).1386113862        - `"global"`1386313864        - `"us"`1386513866      - `model: string or null`1386713868        Model that produced the usage or cost, as a model name in the form the `models[]` filter accepts (for example, `claude-opus-5`). Null unless `model` is in `group_by[]`; it can also be null on grouped rows whose usage or cost is not attributed to a specific model, such as code execution.1386913870      - `output_tokens: number`1387113872        The number of output tokens generated.1387313874      - `product: string or null`1387513876        Product surface that produced the usage or cost. Null unless product is in `group_by[]`; it can also be null on grouped rows whose usage cannot be attributed to a known surface. Values include `chat`, `claude_code`, `cowork`, `office_agent`, `claude_in_chrome`, `claude_design`, and `claude-tag`. `claude-tag` is Claude Tag, the Claude product in Slack. Some unattributed usage is reported as "other".1387713878      - `rbac_group_id: string or null`1387913880        RBAC group (team) the usage is attributed to, in the public tagged `rbac_group_...` spelling — the same spelling the activity resources use for this key, so the same team has one id across resources and it round-trips as an `rbac_group_ids[]` filter value. Populated only when `rbac_group_id` is in `group_by[]`. Any-membership semantics: a user in several groups contributes their full usage to each of those groups' rows, so the named-group rows overlap and their sum can exceed the org total. A null value is the single unassigned row: users in no group on that (UTC) day. For the true org total, run the same query without `group_by[]`.1388113882      - `requests: number or null`1388313884        Number of API requests in this row's scope. For sandbox / code-execution events, this counts execution spans rather than HTTP requests (these rows surface with `product: null`).1388513886      - `server_tool_use: object`1388713888        Server-side tool usage metrics.1388913890        - `web_search_requests: number`1389113892          The number of web search requests made.1389313894      - `slack_channel_id: string or null`1389513896        Slack channel the usage originated from. Populated only when `slack_channel_id` is in `group_by[]`; null for usage outside Slack (and for rows recorded before channel attribution was enabled).1389713898      - `speed: "fast" or "standard" or null`1389913900        Inference speed mode of the usage or cost: `fast` or `standard`. Null unless `speed` is in `group_by[]`.1390113902        - `"fast"`1390313904        - `"standard"`1390513906      - `uncached_input_tokens: number`1390713908        The number of uncached input tokens processed.1390913910    - `starting_at: string`1391113912      Start of the time bucket (inclusive) in RFC 3339 format.1391313914      format: date-time1391513916  - `data_refreshed_at: string or null`1391713918    RFC 3339 timestamp of the export this response was served from. Null when no export yet covers any part of the requested range, in which case every bucket's `results` list is empty. Buckets beyond this watermark are incomplete; for stable results, set `ending_at` to this value or earlier. Data is typically refreshed every 4 hours but not final until about 30 days after the usage date (late-arriving events, reconciliation adjustments).1391913920    format: date-time1392113922  - `has_more: boolean`1392313924    Whether another page is available. When true, pass `next_page` as the `page` parameter to fetch it.1392513926  - `next_page: string or null`1392713928    Opaque cursor for the next page, or null when `has_more` is false. Pass it as the `page` parameter, keeping the other parameters unchanged. A cursor can expire after the underlying data refreshes; the request then returns HTTP 410 and pagination must restart from the first page.1392913930  - `organization_id: string`1393113932    ID of the Organization.1393313934#### Example1393513936```bash13937curl https://api.anthropic.com/v1/organizations/analytics/usage_report \13938    -H 'anthropic-version: 2023-06-01' \13939    -H "X-Api-Key: $ANTHROPIC_API_KEY"13940```1394113942##### Response (200)1394313944```json13945{13946  "data": [13947    {13948      "ending_at": "2019-12-27T18:11:19.117Z",13949      "results": [13950        {13951          "cache_creation": {13952            "ephemeral_1h_input_tokens": 0,13953            "ephemeral_5m_input_tokens": 013954          },13955          "cache_read_input_tokens": 0,13956          "claude_tag_category": "dm",13957          "claude_tag_user_id": "U0123ABCDEF",13958          "context_window": "0-200k",13959          "inference_geo": "global",13960          "model": "claude-opus-5",13961          "output_tokens": 0,13962          "product": "chat",13963          "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",13964          "requests": 0,13965          "server_tool_use": {13966            "web_search_requests": 1013967          },13968          "slack_channel_id": "C0123ABCDEF",13969          "speed": "fast",13970          "uncached_input_tokens": 013971        }13972      ],13973      "starting_at": "2019-12-27T18:11:19.117Z"13974    }13975  ],13976  "data_refreshed_at": "2019-12-27T18:11:19.117Z",13977  "has_more": true,13978  "next_page": "next_page",13979  "organization_id": "org_013FP9SaFPBg7Kw7fetjn6cF"13980}13981```1398213983### Get Per-User Token Usage1398413985**GET** `/v1/organizations/analytics/user_usage_report`1398613987Get per-user token usage across a date range.1398813989Returns one row per user, ranked by the chosen token metric. Use this to13990see which users consume the most tokens. Only usage attributable to a13991seat user is included; for organization-wide totals including direct13992API-key and automation traffic, use the bucketed13993`/v1/organizations/analytics/usage_report` endpoint. Available to13994organizations on a Claude Enterprise plan. Requires an API key with the13995`read:analytics` scope.1399613997#### Query parameters1399813999- `starting_at: string`1400014001  Start of range, inclusive. RFC 3339 tz-aware. Must be within the last 365 days and no earlier than 2026-01-01T00:00:00Z.1400214003  format: date-time1400414005- `bucket_width: optional "1d" or "1h" or "1m"`1400614007  Time-bucket granularity. When set, each row's `starting_at` and `ending_at` are populated and one actor may span several rows (one per time bucket with usage). The time bucket counts toward `limit`, so one page can return multiple rows for the same actor. `ending_at` is required when `bucket_width` is set, and with `bucket_width="1m"` the range may span at most 24 hours. When omitted, each row aggregates the full `[starting_at, ending_at)` range.1400814009  - `"1d"`1401014011  - `"1h"`1401214013  - `"1m"`1401414015- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`1401614017  Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.1401814019  maxItems: 1001402014021  - `"dm"`1402214023  - `"engaged"`1402414025  - `"monitoring"`1402614027  - `"proactive"`1402814029  - `"scheduled"`1403014031- `claude_tag_user_ids: optional array of string`1403214033  Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.1403414035  maxItems: 1001403614037- `context_windows: optional array of "0-200k" or "200k-1M"`1403814039  Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.1404014041  maxItems: 1001404214043  - `"0-200k"`1404414045  - `"200k-1M"`1404614047- `ending_at: optional string`1404814049  End of range, exclusive. When omitted, defaults to the earlier of now and `starting_at` + 31 days. The range may span at most 31 days.1405014051  format: date-time1405214053- `exclude_deleted_users: optional boolean`1405414055  If true, omit rows for users who are deleted (`deleted: true`). A page may contain fewer than `limit` rows; use `has_more` and `next_page` to paginate as usual.1405614057  default: false1405814059- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 6 more`1406014061  Break each actor's row out by the given dimensions. Accepts the same values as the bucketed `/usage_report` endpoint. `limit` bounds (actor × time bucket × dimension) rows — with dimensions or `bucket_width` present, one actor may span several rows.1406214063  maxItems: 1001406414065  - `"claude_tag_category"`1406614067  - `"claude_tag_user_id"`1406814069  - `"context_window"`1407014071  - `"inference_geo"`1407214073  - `"model"`1407414075  - `"product"`1407614077  - `"rbac_group_id"`1407814079  - `"slack_channel_id"`1408014081  - `"speed"`1408214083- `inference_geos: optional array of "global" or "not_available" or "us"`1408414085  Filter to specific inference regions. `not_available` matches rows where the region is unset. Use `group_by[]=inference_geo` to break out per-region values.1408614087  maxItems: 1001408814089  - `"global"`1409014091  - `"not_available"`1409214093  - `"us"`1409414095- `limit: optional number`1409614097  Number of rows per page (1-1000, default 20). One row per actor unless `group_by[]` or `bucket_width` splits an actor across rows; `cost_type`/`token_type` fan-out rows (cost endpoint only) are the exception — they do not count toward this limit, so `data` can exceed it.1409814099  default: 20, maximum: 1000, minimum: 11410014101- `models: optional array of string`1410214103  Models to include. Defaults to all models. Use `group_by[]=model` to break out per-model values.1410414105  maxItems: 1001410614107- `order: optional "asc" or "desc"`1410814109  Sort direction. Defaults to `desc`.1411014111  default: desc1411214113  - `"asc"`1411414115  - `"desc"`1411614117- `order_by: optional "output_tokens" or "requests" or "total_tokens" or "uncached_input_tokens"`1411814119  Metric to rank actors by. Defaults to `total_tokens`.1412014121  default: total_tokens1412214123  - `"output_tokens"`1412414125  - `"requests"`1412614127  - `"total_tokens"`1412814129  - `"uncached_input_tokens"`1413014131- `page: optional string`1413214133  Opaque cursor from a previous response's `next_page` field.1413414135- `products: optional array of "chat" or "claude-tag" or "claude_code" or 4 more`1413614137  Product surfaces to include. Defaults to all products.1413814139  maxItems: 1001414014141  - `"chat"`1414214143  - `"claude-tag"`1414414145  - `"claude_code"`1414614147  - `"claude_design"`1414814149  - `"claude_in_chrome"`1415014151  - `"cowork"`1415214153  - `"office_agent"`1415414155- `rbac_group_ids: optional array of string`1415614157  Filter to usage attributed to specific RBAC groups. Accepts tagged RBAC group IDs (`rbac_group_...`) or bare group UUIDs. A row matches when the user belonged to any of the listed groups on the (UTC) day the usage occurred; usage with no group attribution never matches.1415814159  maxItems: 1001416014161- `slack_channel_ids: optional array of string`1416214163  Filter to usage originating from specific Slack channels. Use `group_by[]=slack_channel_id` to break out per-channel values.1416414165  maxItems: 1001416614167- `speeds: optional array of "fast" or "standard"`1416814169  Filter to fast or standard inference mode. Use `group_by[]=speed` to break out per-mode values.1417014171  maxItems: 1001417214173  - `"fast"`1417414175  - `"standard"`1417614177- `user_ids: optional array of string`1417814179  Filter to specific users by tagged user ID.1418014181  maxItems: 1001418214183#### Returns1418414185- `BetaUserUsage object`1418614187  - `data: array of object`1418814189    Rows for this page, ranked by `order_by` in the `order` direction. One row per user, or several per user when `group_by[]` or `bucket_width` breaks that user's usage or cost out across rows. Rows split out by `cost_type` or `token_type` (cost endpoint only) stay adjacent and are ranked as one unit.1419014191    - `actor: BetaAnalyticsUserActor`1419214193      The user this row's usage or cost is attributed to. Always a `user_actor`.1419414195      - `type: "user_actor"`1419614197        Actor type. Always `"user_actor"`.1419814199      - `deleted: boolean`1420014201        True when the account has been deleted, or when the user is no longer a member of the organization or its associated organizations (for example, their membership was removed or they were deprovisioned via your identity provider). `email` stays populated for removed users and is null when the account has been deleted. `name` follows the rules described on that field. The `user_id` is still populated for reconciliation.1420214203      - `email: string or null`1420414205        The user's email address, including for users who are no longer members of the organization or its associated organizations. Null when the account has been deleted (check `deleted`) and for system-minted service accounts, which have no person's mailbox behind them (check `name`).1420614207      - `name: string or null`1420814209        The user's full name. Null when the user has not set a name. Returns `"Deleted User"` when the account itself has been deleted, or when the user is no longer a member of the organization or its associated organizations and the organization has chosen to hide the names of removed users. Otherwise, the name stays populated for removed users. Rows for system-minted service accounts render the service name (for example, `"Claude Security"` for usage by Anthropic's security-patching service) or null.1421014211      - `user_id: string`1421214213        Tagged user ID.1421414215    - `cache_creation: BetaCacheCreation`1421614217      The number of input tokens for cache creation.1421814219      - `ephemeral_1h_input_tokens: number`1422014221        The number of input tokens used to create the 1 hour cache entry.1422214223        default: 0, minimum: 01422414225      - `ephemeral_5m_input_tokens: number`1422614227        The number of input tokens used to create the 5 minute cache entry.1422814229        default: 0, minimum: 01423014231    - `cache_read_input_tokens: number`1423214233      The number of input tokens read from the cache.1423414235    - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`1423614237      Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.1423814239      - `"dm"`1424014241      - `"engaged"`1424214243      - `"monitoring"`1424414245      - `"proactive"`1424614247      - `"scheduled"`1424814249    - `claude_tag_user_id: string or null`1425014251      Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.1425214253    - `context_window: "0-200k" or "200k-1M" or null`1425414255      Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.1425614257      - `"0-200k"`1425814259      - `"200k-1M"`1426014261    - `ending_at: string or null`1426214263      End of the row's UTC time bucket (exclusive), as an RFC 3339 timestamp; equal to `starting_at` plus one `bucket_width`. Null unless `bucket_width` is set.1426414265      format: date-time1426614267    - `inference_geo: "global" or "us" or null`1426814269      Inference region of the usage or cost. Null unless `inference_geo` is in `group_by[]`; it can also be null on grouped rows where the region is not set (the rows that `inference_geos[]=not_available` matches).1427014271      - `"global"`1427214273      - `"us"`1427414275    - `model: string or null`1427614277      Model that produced the usage or cost, as a model name in the form the `models[]` filter accepts (for example, `claude-opus-5`). Null unless `model` is in `group_by[]`; it can also be null on grouped rows whose usage or cost is not attributed to a specific model, such as code execution.1427814279    - `output_tokens: number`1428014281      The number of output tokens generated.1428214283    - `product: string or null`1428414285      Product surface that produced the usage or cost. Null unless product is in `group_by[]`; it can also be null on grouped rows whose usage cannot be attributed to a known surface. Values include `chat`, `claude_code`, `cowork`, `office_agent`, `claude_in_chrome`, `claude_design`, and `claude-tag`. `claude-tag` is Claude Tag, the Claude product in Slack. Some unattributed usage is reported as "other".1428614287    - `rbac_group_id: string or null`1428814289      RBAC group (team) the usage is attributed to, in the public tagged `rbac_group_...` spelling — the same spelling the activity resources use for this key, so the same team has one id across resources and it round-trips as an `rbac_group_ids[]` filter value. Populated only when `rbac_group_id` is in `group_by[]`. Any-membership semantics: a user in several groups contributes their full usage to each of those groups' rows, so the named-group rows overlap and their sum can exceed the org total. A null value is the single unassigned row: users in no group on that (UTC) day. For the true org total, run the same query without `group_by[]`.1429014291    - `requests: number or null`1429214293      Number of API requests in this row's scope. For sandbox / code-execution events, this counts execution spans rather than HTTP requests (these rows surface with `product: null`).1429414295    - `server_tool_use: object`1429614297      Server-side tool usage metrics.1429814299      - `web_search_requests: number`1430014301        The number of web search requests made.1430214303    - `slack_channel_id: string or null`1430414305      Slack channel the usage originated from. Populated only when `slack_channel_id` is in `group_by[]`; null for usage outside Slack (and for rows recorded before channel attribution was enabled).1430614307    - `speed: "fast" or "standard" or null`1430814309      Inference speed mode of the usage or cost: `fast` or `standard`. Null unless `speed` is in `group_by[]`.1431014311      - `"fast"`1431214313      - `"standard"`1431414315    - `starting_at: string or null`1431614317      Start of the row's UTC time bucket (inclusive), as an RFC 3339 timestamp. Null unless `bucket_width` is set; without `bucket_width`, each row aggregates the full requested range.1431814319      format: date-time1432014321    - `total_tokens: number`1432214323      Total token count across all token types. This is the value the default `order_by` (`total_tokens`) sorts on.1432414325    - `uncached_input_tokens: number`1432614327      The number of uncached input tokens processed.1432814329  - `data_refreshed_at: string or null`1433014331    RFC 3339 timestamp of the export this response was served from. Null when no export yet covers any part of the requested range, in which case `data` is empty. Data beyond this watermark is incomplete; for stable results, set `ending_at` to this value or earlier. Data is typically refreshed every 4 hours but not final until about 30 days after the usage date (late-arriving events, reconciliation adjustments).1433214333    format: date-time1433414335  - `has_more: boolean`1433614337    Whether another page is available. When true, pass `next_page` as the `page` parameter to fetch it.1433814339  - `next_page: string or null`1434014341    Opaque cursor for the next page, or null when `has_more` is false. Pass it as the `page` parameter, keeping the other parameters unchanged. A cursor can expire after the underlying data refreshes; the request then returns HTTP 410 and pagination must restart from the first page.1434214343  - `organization_id: string`1434414345    ID of the Organization.1434614347#### Example1434814349```bash14350curl https://api.anthropic.com/v1/organizations/analytics/user_usage_report \14351    -H 'anthropic-version: 2023-06-01' \14352    -H "X-Api-Key: $ANTHROPIC_API_KEY"14353```1435414355##### Response (200)1435614357```json14358{14359  "data": [14360    {14361      "actor": {14362        "deleted": true,14363        "email": "jane@example.com",14364        "name": "Jane Smith",14365        "type": "user_actor",14366        "user_id": "user_01AbCdEfGhIjKlMnOpQrSt"14367      },14368      "cache_creation": {14369        "ephemeral_1h_input_tokens": 0,14370        "ephemeral_5m_input_tokens": 014371      },14372      "cache_read_input_tokens": 3200000,14373      "claude_tag_category": "dm",14374      "claude_tag_user_id": "U0123ABCDEF",14375      "context_window": "0-200k",14376      "ending_at": "2019-12-27T18:11:19.117Z",14377      "inference_geo": "global",14378      "model": "claude-opus-5",14379      "output_tokens": 891000,14380      "product": "chat",14381      "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",14382      "requests": 128,14383      "server_tool_use": {14384        "web_search_requests": 1014385      },14386      "slack_channel_id": "C0123ABCDEF",14387      "speed": "fast",14388      "starting_at": "2019-12-27T18:11:19.117Z",14389      "total_tokens": 5377000,14390      "uncached_input_tokens": 128450014391    }14392  ],14393  "data_refreshed_at": "2019-12-27T18:11:19.117Z",14394  "has_more": true,14395  "next_page": "next_page",14396  "organization_id": "org_013FP9SaFPBg7Kw7fetjn6cF"14397}14398```1439914400## Organization › Analytics › Cost1440114402### Get Cost Over Time1440314404**GET** `/v1/organizations/analytics/cost_report`1440514406Get cost in USD over time across a date range.1440714408Returns cost bucketed by minute, hour, or day, optionally broken down by14409product, model, context window, inference region, speed, cost type, or14410token type. Available to organizations on a Claude Enterprise plan.14411Requires an API key with the `read:analytics` scope.1441214413#### Query parameters1441414415- `starting_at: string`1441614417  Start of range, inclusive. RFC 3339 tz-aware. Must be within the last 365 days and no earlier than 2026-01-01T00:00:00Z.1441814419  format: date-time1442014421- `bucket_width: optional "1d" or "1h" or "1m"`1442214423  Time bucket granularity.1442414425  default: 1d1442614427  - `"1d"`1442814429  - `"1h"`1443014431  - `"1m"`1443214433- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`1443414435  Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.1443614437  maxItems: 1001443814439  - `"dm"`1444014441  - `"engaged"`1444214443  - `"monitoring"`1444414445  - `"proactive"`1444614447  - `"scheduled"`1444814449- `claude_tag_user_ids: optional array of string`1445014451  Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.1445214453  maxItems: 1001445414455- `context_windows: optional array of "0-200k" or "200k-1M"`1445614457  Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.1445814459  maxItems: 1001446014461  - `"0-200k"`1446214463  - `"200k-1M"`1446414465- `ending_at: optional string`1446614467  End of range, exclusive. When omitted, defaults to the earlier of now and `starting_at` + 31 days. The range may span at most 31 days.1446814469  format: date-time1447014471- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 8 more`1447214473  Dimensions to break each time bucket out by. Defaults to no grouping (one total per bucket). Each bucket reports at most its top 100 groups; a group beyond that cap has no row in that bucket (there is no remainder row), so grouped buckets are not exhaustive when a dimension has more than 100 distinct values.1447414475  maxItems: 1001447614477  - `"claude_tag_category"`1447814479  - `"claude_tag_user_id"`1448014481  - `"context_window"`1448214483  - `"cost_type"`1448414485  - `"inference_geo"`1448614487  - `"model"`1448814489  - `"product"`1449014491  - `"rbac_group_id"`1449214493  - `"slack_channel_id"`1449414495  - `"speed"`1449614497  - `"token_type"`1449814499- `inference_geos: optional array of "global" or "not_available" or "us"`1450014501  Filter to specific inference regions. `not_available` matches rows where the region is unset. Use `group_by[]=inference_geo` to break out per-region values.1450214503  maxItems: 1001450414505  - `"global"`1450614507  - `"not_available"`1450814509  - `"us"`1451014511- `limit: optional number`1451214513  Maximum number of time buckets per page. Defaults and caps vary by `bucket_width` (`1d`: default 7, max 31; `1h`: default 24, max 168; `1m`: default 60, max 256).1451414515  minimum: 11451614517- `models: optional array of string`1451814519  Models to include. Defaults to all models. Use `group_by[]=model` to break out per-model values.1452014521  maxItems: 1001452214523- `page: optional string`1452414525  Opaque cursor from a previous response's `next_page` field.1452614527- `products: optional array of "chat" or "claude-tag" or "claude_code" or 4 more`1452814529  Product surfaces to include. Defaults to all products. Use `group_by[]=product` to break out per-product values.1453014531  maxItems: 1001453214533  - `"chat"`1453414535  - `"claude-tag"`1453614537  - `"claude_code"`1453814539  - `"claude_design"`1454014541  - `"claude_in_chrome"`1454214543  - `"cowork"`1454414545  - `"office_agent"`1454614547- `rbac_group_ids: optional array of string`1454814549  Filter to usage attributed to specific RBAC groups. Accepts tagged RBAC group IDs (`rbac_group_...`) or bare group UUIDs. A row matches when the user belonged to any of the listed groups on the (UTC) day the usage occurred; usage with no group attribution never matches.1455014551  maxItems: 1001455214553- `slack_channel_ids: optional array of string`1455414555  Filter to usage originating from specific Slack channels. Use `group_by[]=slack_channel_id` to break out per-channel values.1455614557  maxItems: 1001455814559- `speeds: optional array of "fast" or "standard"`1456014561  Filter to fast or standard inference mode. Use `group_by[]=speed` to break out per-mode values.1456214563  maxItems: 1001456414565  - `"fast"`1456614567  - `"standard"`1456814569- `user_ids: optional array of string`1457014571  Filter to specific users by tagged user ID.1457214573  maxItems: 1001457414575#### Returns1457614577- `BetaCostBucket object`1457814579  - `data: array of object`1458014581    Time buckets for this page, oldest first: one per `bucket_width` interval, including intervals with no data (their `results` list is empty). A page holds at most `limit` buckets.1458214583    - `ending_at: string`1458414585      End of the time bucket (exclusive) in RFC 3339 format.1458614587      format: date-time1458814589    - `results: array of object`1459014591      Rows for this time bucket. Empty when the bucket has no data; otherwise a single combined row when `group_by[]` is omitted, or one row per group (subject to the per-bucket group cap described on the `group_by[]` parameter).1459214593      - `amount: string`1459414595        Amount (post-discount, pre-credit) in fractional cents.1459614597      - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`1459814599        Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.1460014601        - `"dm"`1460214603        - `"engaged"`1460414605        - `"monitoring"`1460614607        - `"proactive"`1460814609        - `"scheduled"`1461014611      - `claude_tag_user_id: string or null`1461214613        Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.1461414615      - `context_window: "0-200k" or "200k-1M" or null`1461614617        Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.1461814619        - `"0-200k"`1462014621        - `"200k-1M"`1462214623      - `cost_type: "code_execution" or "tokens" or "web_search" or null`1462414625        Cost component when `group_by[]=cost_type`; null otherwise (amount is the combined total).1462614627        - `"code_execution"`1462814629        - `"tokens"`1463014631        - `"web_search"`1463214633      - `currency: "USD"`1463414635        Currency code for the cost amount. Currently always `"USD"`.1463614637        default: USD1463814639      - `inference_geo: "global" or "us" or null`1464014641        Inference region of the usage or cost. Null unless `inference_geo` is in `group_by[]`; it can also be null on grouped rows where the region is not set (the rows that `inference_geos[]=not_available` matches).1464214643        - `"global"`1464414645        - `"us"`1464614647      - `list_amount: string`1464814649        List-price amount (pre-discount) in fractional cents.1465014651      - `model: string or null`1465214653        Model that produced the usage or cost, as a model name in the form the `models[]` filter accepts (for example, `claude-opus-5`). Null unless `model` is in `group_by[]`; it can also be null on grouped rows whose usage or cost is not attributed to a specific model, such as code execution.1465414655      - `product: string or null`1465614657        Product surface that produced the usage or cost. Null unless product is in `group_by[]`; it can also be null on grouped rows whose usage cannot be attributed to a known surface. Values include `chat`, `claude_code`, `cowork`, `office_agent`, `claude_in_chrome`, `claude_design`, and `claude-tag`. `claude-tag` is Claude Tag, the Claude product in Slack. Some unattributed usage is reported as "other".1465814659      - `rbac_group_id: string or null`1466014661        RBAC group (team) the usage is attributed to, in the public tagged `rbac_group_...` spelling — the same spelling the activity resources use for this key, so the same team has one id across resources and it round-trips as an `rbac_group_ids[]` filter value. Populated only when `rbac_group_id` is in `group_by[]`. Any-membership semantics: a user in several groups contributes their full usage to each of those groups' rows, so the named-group rows overlap and their sum can exceed the org total. A null value is the single unassigned row: users in no group on that (UTC) day. For the true org total, run the same query without `group_by[]`.1466214663      - `requests: number or null`1466414665        Number of API requests in this row's scope. Null when `group_by` includes `cost_type` or `token_type` (the count has no per-component attribution; read it from the ungrouped response). For sandbox / code-execution events, this counts execution spans rather than HTTP requests (these rows surface with `product: null`).1466614667      - `slack_channel_id: string or null`1466814669        Slack channel the usage originated from. Populated only when `slack_channel_id` is in `group_by[]`; null for usage outside Slack (and for rows recorded before channel attribution was enabled).1467014671      - `speed: "fast" or "standard" or null`1467214673        Inference speed mode of the usage or cost: `fast` or `standard`. Null unless `speed` is in `group_by[]`.1467414675        - `"fast"`1467614677        - `"standard"`1467814679      - `token_type: "cache_creation.ephemeral_1h_input_tokens" or "cache_creation.ephemeral_5m_input_tokens" or "cache_read_input_tokens" or 2 more or null`1468014681        Token type when `group_by[]=token_type` and `cost_type=tokens`; null otherwise.1468214683        - `"cache_creation.ephemeral_1h_input_tokens"`1468414685        - `"cache_creation.ephemeral_5m_input_tokens"`1468614687        - `"cache_read_input_tokens"`1468814689        - `"output_tokens"`1469014691        - `"uncached_input_tokens"`1469214693    - `starting_at: string`1469414695      Start of the time bucket (inclusive) in RFC 3339 format.1469614697      format: date-time1469814699  - `data_refreshed_at: string or null`1470014701    RFC 3339 timestamp of the export this response was served from. Null when no export yet covers any part of the requested range, in which case every bucket's `results` list is empty. Buckets beyond this watermark are incomplete; for stable results, set `ending_at` to this value or earlier. Data is typically refreshed every 4 hours but not final until about 30 days after the usage date (late-arriving events, reconciliation adjustments).1470214703    format: date-time1470414705  - `has_more: boolean`1470614707    Whether another page is available. When true, pass `next_page` as the `page` parameter to fetch it.1470814709  - `next_page: string or null`1471014711    Opaque cursor for the next page, or null when `has_more` is false. Pass it as the `page` parameter, keeping the other parameters unchanged. A cursor can expire after the underlying data refreshes; the request then returns HTTP 410 and pagination must restart from the first page.1471214713  - `organization_id: string`1471414715    ID of the Organization.1471614717#### Example1471814719```bash14720curl https://api.anthropic.com/v1/organizations/analytics/cost_report \14721    -H 'anthropic-version: 2023-06-01' \14722    -H "X-Api-Key: $ANTHROPIC_API_KEY"14723```1472414725##### Response (200)1472614727```json14728{14729  "data": [14730    {14731      "ending_at": "2019-12-27T18:11:19.117Z",14732      "results": [14733        {14734          "amount": "amount",14735          "claude_tag_category": "dm",14736          "claude_tag_user_id": "U0123ABCDEF",14737          "context_window": "0-200k",14738          "cost_type": "code_execution",14739          "currency": "USD",14740          "inference_geo": "global",14741          "list_amount": "list_amount",14742          "model": "claude-opus-5",14743          "product": "chat",14744          "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",14745          "requests": 0,14746          "slack_channel_id": "C0123ABCDEF",14747          "speed": "fast",14748          "token_type": "cache_creation.ephemeral_1h_input_tokens"14749        }14750      ],14751      "starting_at": "2019-12-27T18:11:19.117Z"14752    }14753  ],14754  "data_refreshed_at": "2019-12-27T18:11:19.117Z",14755  "has_more": true,14756  "next_page": "next_page",14757  "organization_id": "org_013FP9SaFPBg7Kw7fetjn6cF"14758}14759```1476014761### Get Per-User Cost1476214763**GET** `/v1/organizations/analytics/user_cost_report`1476414765Get per-user cost in USD across a date range.1476614767Returns one row per user, ranked by spend. Use this to see which users14768account for the most cost. Only cost attributable to a seat user is14769included; for organization-wide totals including direct API-key and14770automation traffic, use the bucketed14771`/v1/organizations/analytics/cost_report` endpoint. Available to14772organizations on a Claude Enterprise plan. Requires an API key with the14773`read:analytics` scope.1477414775#### Query parameters1477614777- `starting_at: string`1477814779  Start of range, inclusive. RFC 3339 tz-aware. Must be within the last 365 days and no earlier than 2026-01-01T00:00:00Z.1478014781  format: date-time1478214783- `bucket_width: optional "1d" or "1h" or "1m"`1478414785  Time-bucket granularity. When set, each row's `starting_at` and `ending_at` are populated and one actor may span several rows (one per time bucket with usage). The time bucket counts toward `limit`, so one page can return multiple rows for the same actor. `ending_at` is required when `bucket_width` is set, and with `bucket_width="1m"` the range may span at most 24 hours. When omitted, each row aggregates the full `[starting_at, ending_at)` range.1478614787  - `"1d"`1478814789  - `"1h"`1479014791  - `"1m"`1479214793- `claude_tag_categories: optional array of "dm" or "engaged" or "monitoring" or 2 more`1479414795  Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values.1479614797  maxItems: 1001479814799  - `"dm"`1480014801  - `"engaged"`1480214803  - `"monitoring"`1480414805  - `"proactive"`1480614807  - `"scheduled"`1480814809- `claude_tag_user_ids: optional array of string`1481014811  Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values.1481214813  maxItems: 1001481414815- `context_windows: optional array of "0-200k" or "200k-1M"`1481614817  Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values.1481814819  maxItems: 1001482014821  - `"0-200k"`1482214823  - `"200k-1M"`1482414825- `ending_at: optional string`1482614827  End of range, exclusive. When omitted, defaults to the earlier of now and `starting_at` + 31 days. The range may span at most 31 days.1482814829  format: date-time1483014831- `exclude_deleted_users: optional boolean`1483214833  If true, omit rows for users who are deleted (`deleted: true`). A page may contain fewer than `limit` rows; use `has_more` and `next_page` to paginate as usual.1483414835  default: false1483614837- `group_by: optional array of "claude_tag_category" or "claude_tag_user_id" or "context_window" or 8 more`1483814839  Break each actor's row out by the given dimensions. Accepts the same values as the bucketed `/cost_report` endpoint. The `product`, `model`, `context_window`, `inference_geo`, and `speed` dimensions — and the time bucket, when `bucket_width` is set — count toward `limit`. `cost_type` and `token_type` do not: `cost_type` returns one row per cost component (tokens, web search, code execution); `token_type` returns one row per token type, each with `cost_type: "tokens"`; combining both returns the per-token-type rows plus the web-search and code-execution rows. A page can therefore contain more rows than `limit` when `cost_type` or `token_type` is requested.1484014841  maxItems: 1001484214843  - `"claude_tag_category"`1484414845  - `"claude_tag_user_id"`1484614847  - `"context_window"`1484814849  - `"cost_type"`1485014851  - `"inference_geo"`1485214853  - `"model"`1485414855  - `"product"`1485614857  - `"rbac_group_id"`1485814859  - `"slack_channel_id"`1486014861  - `"speed"`1486214863  - `"token_type"`1486414865- `inference_geos: optional array of "global" or "not_available" or "us"`1486614867  Filter to specific inference regions. `not_available` matches rows where the region is unset. Use `group_by[]=inference_geo` to break out per-region values.1486814869  maxItems: 1001487014871  - `"global"`1487214873  - `"not_available"`1487414875  - `"us"`1487614877- `limit: optional number`1487814879  Number of rows per page (1-1000, default 20). One row per actor unless `group_by[]` or `bucket_width` splits an actor across rows; `cost_type`/`token_type` fan-out rows (cost endpoint only) are the exception — they do not count toward this limit, so `data` can exceed it.1488014881  default: 20, maximum: 1000, minimum: 11488214883- `models: optional array of string`1488414885  Models to include. Defaults to all models. Use `group_by[]=model` to break out per-model values.1488614887  maxItems: 1001488814889- `order: optional "asc" or "desc"`1489014891  Sort direction. Defaults to `desc`.1489214893  default: desc1489414895  - `"asc"`1489614897  - `"desc"`1489814899- `order_by: optional "amount" or "list_amount"`1490014901  Metric to rank actors by. Defaults to `amount`.1490214903  default: amount1490414905  - `"amount"`1490614907  - `"list_amount"`1490814909- `page: optional string`1491014911  Opaque cursor from a previous response's `next_page` field.1491214913- `products: optional array of "chat" or "claude-tag" or "claude_code" or 4 more`1491414915  Product surfaces to include. Defaults to all products.1491614917  maxItems: 1001491814919  - `"chat"`1492014921  - `"claude-tag"`1492214923  - `"claude_code"`1492414925  - `"claude_design"`1492614927  - `"claude_in_chrome"`1492814929  - `"cowork"`1493014931  - `"office_agent"`1493214933- `rbac_group_ids: optional array of string`1493414935  Filter to usage attributed to specific RBAC groups. Accepts tagged RBAC group IDs (`rbac_group_...`) or bare group UUIDs. A row matches when the user belonged to any of the listed groups on the (UTC) day the usage occurred; usage with no group attribution never matches.1493614937  maxItems: 1001493814939- `slack_channel_ids: optional array of string`1494014941  Filter to usage originating from specific Slack channels. Use `group_by[]=slack_channel_id` to break out per-channel values.1494214943  maxItems: 1001494414945- `speeds: optional array of "fast" or "standard"`1494614947  Filter to fast or standard inference mode. Use `group_by[]=speed` to break out per-mode values.1494814949  maxItems: 1001495014951  - `"fast"`1495214953  - `"standard"`1495414955- `user_ids: optional array of string`1495614957  Filter to specific users by tagged user ID.1495814959  maxItems: 1001496014961#### Returns1496214963- `BetaUserCost object`1496414965  - `data: array of object`1496614967    Rows for this page, ranked by `order_by` in the `order` direction. One row per user, or several per user when `group_by[]` or `bucket_width` breaks that user's usage or cost out across rows. Rows split out by `cost_type` or `token_type` (cost endpoint only) stay adjacent and are ranked as one unit.1496814969    - `actor: BetaAnalyticsUserActor`1497014971      The user this row's usage or cost is attributed to. Always a `user_actor`.1497214973      - `type: "user_actor"`1497414975        Actor type. Always `"user_actor"`.1497614977      - `deleted: boolean`1497814979        True when the account has been deleted, or when the user is no longer a member of the organization or its associated organizations (for example, their membership was removed or they were deprovisioned via your identity provider). `email` stays populated for removed users and is null when the account has been deleted. `name` follows the rules described on that field. The `user_id` is still populated for reconciliation.1498014981      - `email: string or null`1498214983        The user's email address, including for users who are no longer members of the organization or its associated organizations. Null when the account has been deleted (check `deleted`) and for system-minted service accounts, which have no person's mailbox behind them (check `name`).1498414985      - `name: string or null`1498614987        The user's full name. Null when the user has not set a name. Returns `"Deleted User"` when the account itself has been deleted, or when the user is no longer a member of the organization or its associated organizations and the organization has chosen to hide the names of removed users. Otherwise, the name stays populated for removed users. Rows for system-minted service accounts render the service name (for example, `"Claude Security"` for usage by Anthropic's security-patching service) or null.1498814989      - `user_id: string`1499014991        Tagged user ID.1499214993    - `amount: string`1499414995      Amount (post-discount, pre-credit) in fractional cents (minor units).1499614997    - `claude_tag_category: "dm" or "engaged" or "monitoring" or 2 more or null`1499814999      Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time.1500015001      - `"dm"`1500215003      - `"engaged"`1500415005      - `"monitoring"`1500615007      - `"proactive"`1500815009      - `"scheduled"`1501015011    - `claude_tag_user_id: string or null`1501215013      Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter.1501415015    - `context_window: "0-200k" or "200k-1M" or null`1501615017      Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution.1501815019      - `"0-200k"`1502015021      - `"200k-1M"`1502215023    - `cost_type: "code_execution" or "tokens" or "web_search" or null`1502415025      Cost component breakdown; null when returning the combined total.1502615027      - `"code_execution"`1502815029      - `"tokens"`1503015031      - `"web_search"`1503215033    - `currency: "USD"`1503415035      Currency code for the cost amount. Currently always `"USD"`.1503615037      default: USD1503815039    - `ending_at: string or null`1504015041      End of the row's UTC time bucket (exclusive), as an RFC 3339 timestamp; equal to `starting_at` plus one `bucket_width`. Null unless `bucket_width` is set.1504215043      format: date-time1504415045    - `inference_geo: "global" or "us" or null`1504615047      Inference region of the usage or cost. Null unless `inference_geo` is in `group_by[]`; it can also be null on grouped rows where the region is not set (the rows that `inference_geos[]=not_available` matches).1504815049      - `"global"`1505015051      - `"us"`1505215053    - `list_amount: string`1505415055      List-price amount (pre-discount) in fractional cents.1505615057    - `model: string or null`1505815059      Model that produced the usage or cost, as a model name in the form the `models[]` filter accepts (for example, `claude-opus-5`). Null unless `model` is in `group_by[]`; it can also be null on grouped rows whose usage or cost is not attributed to a specific model, such as code execution.1506015061    - `product: string or null`1506215063      Product surface that produced the usage or cost. Null unless product is in `group_by[]`; it can also be null on grouped rows whose usage cannot be attributed to a known surface. Values include `chat`, `claude_code`, `cowork`, `office_agent`, `claude_in_chrome`, `claude_design`, and `claude-tag`. `claude-tag` is Claude Tag, the Claude product in Slack. Some unattributed usage is reported as "other".1506415065    - `rbac_group_id: string or null`1506615067      RBAC group (team) the usage is attributed to, in the public tagged `rbac_group_...` spelling — the same spelling the activity resources use for this key, so the same team has one id across resources and it round-trips as an `rbac_group_ids[]` filter value. Populated only when `rbac_group_id` is in `group_by[]`. Any-membership semantics: a user in several groups contributes their full usage to each of those groups' rows, so the named-group rows overlap and their sum can exceed the org total. A null value is the single unassigned row: users in no group on that (UTC) day. For the true org total, run the same query without `group_by[]`.1506815069    - `requests: number or null`1507015071      Number of API requests in this row's scope. Null when `group_by` includes `cost_type` or `token_type` (the count has no per-component attribution; read it from the ungrouped response). For sandbox / code-execution events, this counts execution spans rather than HTTP requests (these rows surface with `product: null`).1507215073    - `slack_channel_id: string or null`1507415075      Slack channel the usage originated from. Populated only when `slack_channel_id` is in `group_by[]`; null for usage outside Slack (and for rows recorded before channel attribution was enabled).1507615077    - `speed: "fast" or "standard" or null`1507815079      Inference speed mode of the usage or cost: `fast` or `standard`. Null unless `speed` is in `group_by[]`.1508015081      - `"fast"`1508215083      - `"standard"`1508415085    - `starting_at: string or null`1508615087      Start of the row's UTC time bucket (inclusive), as an RFC 3339 timestamp. Null unless `bucket_width` is set; without `bucket_width`, each row aggregates the full requested range.1508815089      format: date-time1509015091    - `token_type: "cache_creation.ephemeral_1h_input_tokens" or "cache_creation.ephemeral_5m_input_tokens" or "cache_read_input_tokens" or 2 more or null`1509215093      Token type when `cost_type` is `tokens`; null otherwise.1509415095      - `"cache_creation.ephemeral_1h_input_tokens"`1509615097      - `"cache_creation.ephemeral_5m_input_tokens"`1509815099      - `"cache_read_input_tokens"`1510015101      - `"output_tokens"`1510215103      - `"uncached_input_tokens"`1510415105  - `data_refreshed_at: string or null`1510615107    RFC 3339 timestamp of the export this response was served from. Null when no export yet covers any part of the requested range, in which case `data` is empty. Data beyond this watermark is incomplete; for stable results, set `ending_at` to this value or earlier. Data is typically refreshed every 4 hours but not final until about 30 days after the usage date (late-arriving events, reconciliation adjustments).1510815109    format: date-time1511015111  - `has_more: boolean`1511215113    Whether another page is available. When true, pass `next_page` as the `page` parameter to fetch it.1511415115  - `next_page: string or null`1511615117    Opaque cursor for the next page, or null when `has_more` is false. Pass it as the `page` parameter, keeping the other parameters unchanged. A cursor can expire after the underlying data refreshes; the request then returns HTTP 410 and pagination must restart from the first page.1511815119  - `organization_id: string`1512015121    ID of the Organization.1512215123#### Example1512415125```bash15126curl https://api.anthropic.com/v1/organizations/analytics/user_cost_report \15127    -H 'anthropic-version: 2023-06-01' \15128    -H "X-Api-Key: $ANTHROPIC_API_KEY"15129```1513015131##### Response (200)1513215133```json15134{15135  "data": [15136    {15137      "actor": {15138        "deleted": true,15139        "email": "jane@example.com",15140        "name": "Jane Smith",15141        "type": "user_actor",15142        "user_id": "user_01AbCdEfGhIjKlMnOpQrSt"15143      },15144      "amount": "41280.000000",15145      "claude_tag_category": "dm",15146      "claude_tag_user_id": "U0123ABCDEF",15147      "context_window": "0-200k",15148      "cost_type": "code_execution",15149      "currency": "USD",15150      "ending_at": "2019-12-27T18:11:19.117Z",15151      "inference_geo": "global",15152      "list_amount": "51600.000000",15153      "model": "claude-opus-5",15154      "product": "chat",15155      "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",15156      "requests": 128,15157      "slack_channel_id": "C0123ABCDEF",15158      "speed": "fast",15159      "starting_at": "2019-12-27T18:11:19.117Z",15160      "token_type": "cache_creation.ephemeral_1h_input_tokens"15161    }15162  ],15163  "data_refreshed_at": "2019-12-27T18:11:19.117Z",15164  "has_more": true,15165  "next_page": "next_page",15166  "organization_id": "org_013FP9SaFPBg7Kw7fetjn6cF"15167}15168```1516915170## Organization › Analytics › Users1517115172### List User Activity1517315174**GET** `/v1/organizations/analytics/users`1517515176Get per-user activity for a given day, with cursor-based pagination.1517715178Returns activity metrics for each user in the organization, sorted by email15179address. Use `group_by[]` for per-RBAC-group aggregates, or `filter[]` to15180scope results to specific members, groups, or a chat project. Available15181to organizations on a Claude Enterprise plan. Requires an API key with15182the `read:analytics` scope.1518315184#### Query parameters1518515186- `date: optional string`1518715188  UTC date in YYYY-MM-DD format. The day to get user activity for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.1518915190  format: date1519115192- `ending_date: optional string`1519315194  UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`.1519515196  format: date1519715198- `filter: optional array of string`1519915200  Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `project_id`, `rbac_group_id`, `user_id`. Value forms: `project_id` takes a tagged project id (`claude_proj_...`) and scopes each member's row to their claude.ai chat activity within that project (it cannot be combined with `group_by[]` or an `rbac_group_id` filter); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries.1520115202  maxItems: 1001520315204- `group_by: optional array of "rbac_group_id"`1520515206  Dimensions to break results out by (e.g. `group_by[]=rbac_group_id`). Supported on this endpoint: `rbac_group_id`. Rows are already per-member, so the one supported grouping aggregates them per RBAC group instead. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries.1520715208  maxItems: 1001520915210- `limit: optional number`1521115212  Number of results per page (1-1000, default 100).1521315214  minimum: 1, maximum: 10001521515216- `order: optional "asc" or "desc"`1521715218  Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted.1521915220  - `"asc"`1522115222  - `"desc"`1522315224- `order_by: optional string`1522515226  Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set).1522715228- `page: optional string`1522915230  Opaque cursor from a previous response's `next_page` field.1523115232- `starting_date: optional string`1523315234  UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.1523515236  format: date1523715238#### Returns1523915240- `BetaUserActivity object`1524115242  Response for GET /v1/organizations/analytics/users.1524315244  - `data: array of object`1524515246    - `chat_metrics: object`1524715248      Claude.ai activity metrics for a single user on a given day.1524915250      - `connectors_used_count: number`1525115252        Number of MCP connector invocations.1525315254      - `distinct_artifacts_created_count: number`1525515256        Number of distinct artifacts created. Exact in date-range mode: a creation belongs to exactly one day, so the per-day counts never overlap and their sum over the window is the exact count of distinct creations in it.1525715258      - `distinct_connectors_used_count: number or null`1525915260        Distinct claude.ai connectors this user used. Excludes calls whose connector could not be identified and all calls from organizations with zero data retention. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1526115262      - `distinct_conversation_count: number or null`1526315264        Number of distinct conversations the user participated in. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1526515266      - `distinct_files_uploaded_count: number or null`1526715268        Number of distinct files uploaded. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1526915270      - `distinct_projects_created_count: number`1527115272        Number of distinct projects created. Exact in date-range mode: a creation belongs to exactly one day, so the per-day counts never overlap and their sum over the window is the exact count of distinct creations in it.1527315274      - `distinct_projects_used_count: number or null`1527515276        Number of distinct projects used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1527715278      - `distinct_shared_artifacts_viewed_count: number or null`1527915280        Number of distinct shared artifacts the user viewed. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1528115282      - `distinct_skills_used_count: number or null`1528315284        Number of distinct skills used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1528515286      - `message_count: number`1528715288        Number of messages sent1528915290      - `shared_conversations_viewed_count: number`1529115292        Number of times the user opened a shared conversation in a project1529315294      - `thinking_message_count: number`1529515296        Number of messages that used extended thinking1529715298    - `claude_code_metrics: object`1529915300      Claude Code activity metrics for a single user on a given day.1530115302      - `core_metrics: object`1530315304        Core Claude Code activity metrics for a single user on a given day.1530515306        - `artifacts_created_count: number`1530715308          Number of artifacts created in Claude Code sessions: an artifact counts once, on the day a session first saves it. Counted from 2026-08-17; 0 on earlier days. Exact in date-range mode: a creation belongs to exactly one day, so the per-day counts never overlap and their sum over the window is the exact count of distinct creations in it.1530915310        - `commit_count: number`1531115312          Number of commits made via Claude Code1531315314        - `distinct_session_count: number or null`1531515316          Number of distinct Claude Code sessions. On aggregated rows and in date-range mode: summed per-day distinct counts. A session essentially never spans a UTC day, so the sum is in practice the true distinct count.1531715318        - `lines_of_code: object`1531915320          Lines of code added and removed via Claude Code.1532115322          - `added_count: number`1532315324            Lines of code added1532515326          - `removed_count: number`1532715328            Lines of code removed1532915330        - `pull_request_count: number`1533115332          Number of pull requests created via Claude Code1533315334      - `tool_actions: object`1533515336        Per-tool accepted/rejected counts for Claude Code file modification tools.1533715338        - `edit_tool: BetaToolActionCounts`1533915340          Accepted/rejected counts for a single Claude Code tool type.1534115342          - `accepted_count: number`1534315344            Number of tool proposals accepted1534515346          - `rejected_count: number`1534715348            Number of tool proposals rejected1534915350        - `multi_edit_tool: BetaToolActionCounts`1535115352          Accepted/rejected counts for a single Claude Code tool type.1535315354        - `notebook_edit_tool: BetaToolActionCounts`1535515356          Accepted/rejected counts for a single Claude Code tool type.1535715358        - `write_tool: BetaToolActionCounts`1535915360          Accepted/rejected counts for a single Claude Code tool type.1536115362    - `cowork_metrics: object`1536315364      Cowork activity metrics for a single user on a given day.1536515366      - `action_count: number`1536715368        Number of tool actions completed in Cowork sessions1536915370      - `artifacts_created_count: number`1537115372        Number of artifacts created in Cowork sessions: an artifact counts once, on the day a session first saves it. Counted from 2026-08-17; 0 on earlier days. Exact in date-range mode: a creation belongs to exactly one day, so the per-day counts never overlap and their sum over the window is the exact count of distinct creations in it.1537315374      - `connectors_used_count: number`1537515376        Total number of connector invocations in Cowork sessions1537715378      - `dispatch_turn_count: number`1537915380        Number of Dispatch (background agent) turns completed1538115382      - `distinct_connectors_used_count: number or null`1538315384        Number of distinct connectors used in Cowork sessions. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1538515386      - `distinct_session_count: number or null`1538715388        Number of distinct Cowork sessions. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1538915390      - `distinct_skills_used_count: number or null`1539115392        Number of distinct skills used in Cowork sessions. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1539315394      - `message_count: number`1539515396        Number of messages sent in Cowork sessions1539715398      - `skills_used_count: number`1539915400        Total number of skill invocations in Cowork sessions1540115402      - `distinct_plugins_used_count: optional number or null`1540315404        Number of distinct plugins used in Cowork sessions. Null while Cowork plugin-use metrics are not enabled for this organization. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1540515406      - `edit_tool_count: optional number or null`1540715408        Number of successful Edit tool calls in Cowork sessions. Null while the file-edit metrics are not enabled for this organization.1540915410      - `file_edit_count: optional number or null`1541115412        Number of successful file-edit tool calls (Edit, MultiEdit, Write, NotebookEdit) in Cowork sessions. Null, never 0, while the file-edit metrics are not enabled for this organization.1541315414      - `multi_edit_tool_count: optional number or null`1541515416        Number of successful MultiEdit tool calls in Cowork sessions. Null while the file-edit metrics are not enabled for this organization.1541715418      - `notebook_edit_tool_count: optional number or null`1541915420        Number of successful NotebookEdit tool calls in Cowork sessions. Null while the file-edit metrics are not enabled for this organization.1542115422      - `plugins_used_count: optional number or null`1542315424        Total number of plugin invocations in Cowork sessions. Null while Cowork plugin-use metrics are not enabled for this organization.1542515426      - `sessions_with_file_edits_count: optional number or null`1542715428        Number of distinct Cowork sessions with at least one successful file-edit tool call. Null while the file-edit metrics are not enabled for this organization. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1542915430      - `write_tool_count: optional number or null`1543115432        Number of successful Write tool calls in Cowork sessions. Null while the file-edit metrics are not enabled for this organization.1543315434    - `design_metrics: object`1543515436      Claude Design activity metrics for a single user on a given day.1543715438      - `distinct_projects_created_count: number`1543915440        Number of distinct Claude Design projects created. Exact in date-range mode: a creation belongs to exactly one day, so the per-day counts never overlap and their sum over the window is the exact count of distinct creations in it.1544115442      - `distinct_projects_used_count: number or null`1544315444        Number of distinct Claude Design projects the user worked in. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1544515446      - `distinct_session_count: number or null`1544715448        Number of distinct Claude Design sessions. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1544915450      - `message_count: number`1545115452        Number of messages sent in Claude Design sessions1545315454    - `office_metrics: object`1545515456      Office Agent activity metrics for a single user on a given day, broken out by Office product.1545715458      - `excel: BetaOfficeProductMetrics`1545915460        Office Agent activity metrics for a single user on a given day within one Office product.1546115462        - `connectors_used_count: number`1546315464          Number of MCP connector invocations1546515466        - `distinct_connectors_used_count: number or null`1546715468          Number of distinct MCP connectors used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1546915470        - `distinct_session_count: number or null`1547115472          Number of distinct Office Agent sessions. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1547315474        - `distinct_skills_used_count: number or null`1547515476          Number of distinct skills used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1547715478        - `message_count: number`1547915480          Number of messages sent1548115482        - `skills_used_count: number`1548315484          Number of skill invocations1548515486      - `outlook: BetaOfficeProductMetrics`1548715488        Office Agent activity metrics for a single user on a given day within one Office product.1548915490      - `powerpoint: BetaOfficeProductMetrics`1549115492        Office Agent activity metrics for a single user on a given day within one Office product.1549315494      - `word: BetaOfficeProductMetrics`1549515496        Office Agent activity metrics for a single user on a given day within one Office product.1549715498    - `science_metrics: object`1549915500      Claude Science activity metrics for a single user on a given day.1550115502      - `delegation_count: number`1550315504        Number of delegations (handoffs to a specialized agent) in Claude Science sessions1550515506      - `distinct_session_count: number or null`1550715508        Number of distinct Claude Science sessions. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1550915510      - `message_count: number`1551115512        Number of messages sent in Claude Science sessions1551315514      - `remote_compute_job_count: number`1551515516        Number of remote compute jobs launched from Claude Science sessions1551715518      - `skills_used_count: number`1551915520        Total number of skill invocations in Claude Science sessions1552115522    - `web_search_count: number`1552315524      Number of web searches performed1552515526    - `distinct_user_count: optional number or null`1552715528      Number of distinct active users represented by this row. Only set for grouped rollups (`group_by[]`); null for per-user rows. In date-range mode, recomputed as an exact distinct count of the group's active members over the requested window, never a sum of per-day values.1552915530    - `last_activity_date: optional string or null`1553115532      Most recent UTC day (YYYY-MM-DD) on which the user had any counted activity, within the requested window: equal to the requested `date` in single-day mode, and to the latest active day from `starting_date` (inclusive) to `ending_date` (exclusive) in date-range rollup mode — never a day earlier than the window start. On filtered requests (`filter[]`) only days matching the filter count: with `filter[]=rbac_group_id:{id}` it is the last day the user was active while a member of that group, consistent with the row's other metrics. On grouped (`group_by[]`) rows it is the latest day any member of the group was active (the requested `date` in single-day mode). Omitted from the response while last-activity reporting is not enabled for this organization.1553315534      format: date1553515536    - `rbac_group_id: optional string or null`1553715538      Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`.1553915540    - `rbac_group_name: optional string or null`1554115542      Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key.1554315544    - `user: optional BetaAnalyticsUser or null`1554515546      A user in the organization, identified by tagged id and email address.1554715548      - `type: "user"`1554915550        Object type. Always `user`.1555115552        default: user1555315554      - `id: string`1555515556        Tagged user identifier (e.g. `user_...`)1555715558      - `email_address: string`1555915560        Email address of the user1556115562  - `next_page: string or null`1556315564    Opaque cursor for the next page, or null if no more results1556515566#### Example1556715568```bash15569curl https://api.anthropic.com/v1/organizations/analytics/users \15570    -H 'anthropic-version: 2023-06-01' \15571    -H "X-Api-Key: $ANTHROPIC_API_KEY"15572```1557315574##### Response (200)1557515576```json15577{15578  "data": [15579    {15580      "chat_metrics": {15581        "connectors_used_count": 0,15582        "distinct_artifacts_created_count": 0,15583        "distinct_connectors_used_count": 0,15584        "distinct_conversation_count": 0,15585        "distinct_files_uploaded_count": 0,15586        "distinct_projects_created_count": 0,15587        "distinct_projects_used_count": 0,15588        "distinct_shared_artifacts_viewed_count": 0,15589        "distinct_skills_used_count": 0,15590        "message_count": 0,15591        "shared_conversations_viewed_count": 0,15592        "thinking_message_count": 015593      },15594      "claude_code_metrics": {15595        "core_metrics": {15596          "artifacts_created_count": 0,15597          "commit_count": 0,15598          "distinct_session_count": 0,15599          "lines_of_code": {15600            "added_count": 0,15601            "removed_count": 015602          },15603          "pull_request_count": 015604        },15605        "tool_actions": {15606          "edit_tool": {15607            "accepted_count": 0,15608            "rejected_count": 015609          },15610          "multi_edit_tool": {15611            "accepted_count": 0,15612            "rejected_count": 015613          },15614          "notebook_edit_tool": {15615            "accepted_count": 0,15616            "rejected_count": 015617          },15618          "write_tool": {15619            "accepted_count": 0,15620            "rejected_count": 015621          }15622        }15623      },15624      "cowork_metrics": {15625        "action_count": 0,15626        "artifacts_created_count": 0,15627        "connectors_used_count": 0,15628        "dispatch_turn_count": 0,15629        "distinct_connectors_used_count": 0,15630        "distinct_session_count": 0,15631        "distinct_skills_used_count": 0,15632        "message_count": 0,15633        "skills_used_count": 0,15634        "distinct_plugins_used_count": 0,15635        "edit_tool_count": 0,15636        "file_edit_count": 0,15637        "multi_edit_tool_count": 0,15638        "notebook_edit_tool_count": 0,15639        "plugins_used_count": 0,15640        "sessions_with_file_edits_count": 0,15641        "write_tool_count": 015642      },15643      "design_metrics": {15644        "distinct_projects_created_count": 0,15645        "distinct_projects_used_count": 0,15646        "distinct_session_count": 0,15647        "message_count": 015648      },15649      "office_metrics": {15650        "excel": {15651          "connectors_used_count": 0,15652          "distinct_connectors_used_count": 0,15653          "distinct_session_count": 0,15654          "distinct_skills_used_count": 0,15655          "message_count": 0,15656          "skills_used_count": 015657        },15658        "outlook": {15659          "connectors_used_count": 0,15660          "distinct_connectors_used_count": 0,15661          "distinct_session_count": 0,15662          "distinct_skills_used_count": 0,15663          "message_count": 0,15664          "skills_used_count": 015665        },15666        "powerpoint": {15667          "connectors_used_count": 0,15668          "distinct_connectors_used_count": 0,15669          "distinct_session_count": 0,15670          "distinct_skills_used_count": 0,15671          "message_count": 0,15672          "skills_used_count": 015673        },15674        "word": {15675          "connectors_used_count": 0,15676          "distinct_connectors_used_count": 0,15677          "distinct_session_count": 0,15678          "distinct_skills_used_count": 0,15679          "message_count": 0,15680          "skills_used_count": 015681        }15682      },15683      "science_metrics": {15684        "delegation_count": 0,15685        "distinct_session_count": 0,15686        "message_count": 0,15687        "remote_compute_job_count": 0,15688        "skills_used_count": 015689      },15690      "web_search_count": 0,15691      "distinct_user_count": 0,15692      "last_activity_date": "2019-12-27",15693      "rbac_group_id": "rbac_group_id",15694      "rbac_group_name": "rbac_group_name",15695      "user": {15696        "id": "id",15697        "email_address": "email_address",15698        "type": "user"15699      }15700    }15701  ],15702  "next_page": "next_page"15703}15704```1570515706## Organization › Analytics › Skills1570715708### Get Skill Usage1570915710**GET** `/v1/organizations/analytics/skills`1571115712Get per-skill usage for a given day, with cursor-based pagination.1571315714Returns skill usage metrics for the organization, sorted by skill name.15715Use `group_by[]` to break usage out per member, per RBAC group, or per15716product surface, and `filter[]` to scope results; the parameter15717descriptions list the supported dimensions. Available to organizations15718on a Claude Enterprise plan. Requires an API key with the15719`read:analytics` scope.1572015721#### Query parameters1572215723- `date: optional string`1572415725  UTC date in YYYY-MM-DD format. The day to get skill usage for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.1572615727  format: date1572815729- `ending_date: optional string`1573015731  UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`.1573215733  format: date1573415735- `filter: optional array of string`1573615737  Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `product`, `rbac_group_id`, `share_status`, `skill_name`, `user_id`. Value forms: `product` is one of `chat`, `claude_code`, `cowork`, or `office_agent`; `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `share_status` is one of `organization`, `private`, or `public`; `skill_name` matches case-insensitively; `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries.1573815739  maxItems: 1001574015741- `group_by: optional array of "product" or "rbac_group_id" or "user_id"`1574215743  Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `product`, `rbac_group_id`, `user_id`. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries.1574415745  maxItems: 1001574615747  - `"product"`1574815749  - `"rbac_group_id"`1575015751  - `"user_id"`1575215753- `limit: optional number`1575415755  Number of results per page (1-1000, default 100).1575615757  minimum: 1, maximum: 10001575815759- `order: optional "asc" or "desc"`1576015761  Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted.1576215763  - `"asc"`1576415765  - `"desc"`1576615767- `order_by: optional string`1576815769  Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set).1577015771- `page: optional string`1577215773  Opaque cursor from a previous response's `next_page` field.1577415775- `starting_date: optional string`1577615777  UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.1577815779  format: date1578015781#### Returns1578215783- `BetaSkillUsage object`1578415785  Response for GET /v1/organizations/analytics/skills.1578615787  - `data: array of object`1578815789    - `chat_metrics: object`1579015791      Claude.ai activity metrics for a single skill on a given day.1579215793      - `distinct_conversation_skill_used_count: number or null`1579415795        Number of distinct conversations in which the skill was used. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1579615797    - `claude_code_metrics: object`1579815799      Claude Code activity metrics for a single skill on a given day.1580015801      - `distinct_session_skill_used_count: number or null`1580215803        Number of distinct Claude Code sessions in which the skill was used. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1580415805    - `cowork_metrics: object`1580615807      Cowork activity metrics for a single skill on a given day.1580815809      - `distinct_session_skill_used_count: number or null`1581015811        Number of distinct Cowork sessions in which the skill was used. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1581215813    - `distinct_user_count: number`1581415815      Number of distinct users who used the skill on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted.1581615817    - `office_metrics: object`1581815819      Office Agent activity metrics for a single skill on a given day, broken out by Office product.1582015821      - `excel: BetaSkillOfficeProductMetrics`1582215823        Office Agent activity metrics for a single skill on a given day within one Office product.1582415825        - `distinct_session_skill_used_count: number or null`1582615827          Number of distinct Office Agent sessions in which the skill was used. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1582815829      - `outlook: BetaSkillOfficeProductMetrics`1583015831        Office Agent activity metrics for a single skill on a given day within one Office product.1583215833      - `powerpoint: BetaSkillOfficeProductMetrics`1583415835        Office Agent activity metrics for a single skill on a given day within one Office product.1583615837      - `word: BetaSkillOfficeProductMetrics`1583815839        Office Agent activity metrics for a single skill on a given day within one Office product.1584015841    - `skill_name: string`1584215843      Name of the skill1584415845    - `attributed_list_price: optional string or null`1584615847      List-price (rate-card) value of the member requests attributed to this skill, as a decimal string in the minor unit of `currency` (cents for USD), from Claude Code, Cowork, and Office Agent request-level attribution — the value of requests that involved the skill, not the skill's incremental cost. Unlike `estimated_overage_spend` this reflects usage value regardless of how it was funded — seat-covered usage counts — but it is undiscounted and does not tie to billed spend or the organization's spend reporting. claude.ai chat usage carries no request-level attribution and contributes nothing: the field is null on `chat` product rows and on `office_agent` product cuts dated before 2026-06-18 (the Office Agent attribution data-start), and on ungrouped rows it covers the Claude Code + Cowork + Office Agent share only (null when no attributable usage exists). Also null under the same conditions as `estimated_overage_spend` (spend reporting not enabled for this organization, `office_agent` product cuts before the 2026-06-18 data-start). "0" means attributable usage existed but none was attributed to this skill. Addable across days: date-range rollup mode returns the window's sum. On `group_by[]` and `filter[]` shapes both amounts can total below the ungrouped value for the same skill over the same date or range: spend attributed to a member–skill pair with no counted usage on that day is excluded from those cuts.1584815849    - `currency: optional "USD" or null`1585015851      Currency for this row's monetary fields (`estimated_overage_spend` and `attributed_list_price`), as an uppercase ISO-4217 code. Always "USD" when either amount is populated; null whenever both amounts are null.1585215853    - `enable_count: optional number or null`1585415855      Distinct accounts that enabled this skill on the requested day (claude.ai only — the skill analog of plugin `install_count`). The count is org-wide: null when enable reporting is not enabled for this organization, or when the request scopes to `user_id` / `rbac_group_id` / `product` via `group_by[]` or `filter[]` (an org-wide count would be misleading on per-cut rows). A distinct count, not an event count: summing across days double-counts members who enable the skill on more than one day, so it is also null in date-range rollup mode (`starting_date`/`ending_date`).1585615857    - `estimated_overage_spend: optional string or null`1585815859      Estimated overage spend attributed to this skill, as a decimal string in the minor unit of `currency` (cents for USD; "1250" is $12.50, fractional cents possible) — an allocation of each member's daily post-discount, pre-credit metered overage spend (the same cost basis as the organization's spend reporting and the Cost & Usage API, so per-skill figures are directly comparable; spend with no skill attribution — including any member-day without skill invocations — is not represented, so skill rows sum to at most those totals) across the skills the member used. Overage only: usage covered by included seat allowances bills nothing and allocates $0 here — see `attributed_list_price` for the funding-independent usage-value companion. Claude Code, Cowork, and Office Agent spend use request-level skill attribution; claude.ai chat spend is approximated proportionally to skill-invoking messages. An estimate, not a billing number — and the cost of the requests/messages that involved the skill, not the skill's incremental cost (the same request would still have cost something without the skill active). "0" means no overage spend was attributed; null when spend reporting is not enabled for this organization, on `office_agent` product cuts dated before 2026-06-18 (the Office Agent attribution data-start). Addable across days: date-range rollup mode (`starting_date`/`ending_date`) returns the window's sum. With `group_by[]=user_id` each row carries the user's own attributed spend. On `group_by[]` and `filter[]` shapes both amounts can total below the ungrouped value for the same skill over the same date or range: spend attributed to a member–skill pair with no counted usage on that day is excluded from those cuts.1586015861    - `invocation_count: optional number or null`1586215863      Total number of times this skill was invoked on the requested day (the skill analog of plugin `invocation_count`). Unlike `distinct_user_count` — which answers '\# of users' — this is the true '# of uses'. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted. Null when invocation reporting is not enabled for this organization. Sum across a date range for total uses in the window — date-range rollup mode (`starting_date`/`ending_date`) returns this sum directly.1586415865    - `product: optional string or null`1586615867      Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, or `office_agent` (the canonical Cost & Usage product naming; an `office_agent` row's per-surface breakdown is in its `office_metrics`). On `/plugins` only `cowork` and `claude_code` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, and `cowork` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`.1586815869    - `rbac_group_id: optional string or null`1587015871      Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`.1587215873    - `rbac_group_name: optional string or null`1587415875      Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key.1587615877    - `share_status: optional "organization" or "private" or "public" or null`1587815879      Skill share status (claude.ai only): one of `private`, `organization`, or `public`. Null for skills used only in Claude Code or Office (no per-skill share-status concept) and when share-status reporting is not yet available for the organization. Filterable via `filter[]=share_status:{value}`.1588015881      - `"organization"`1588215883      - `"private"`1588415885      - `"public"`1588615887    - `skill_display_name: optional string or null`1588815889      Human-readable display name for rows whose `skill_name` is an opaque skill id (user/organization skill types and plugin-delivered skills — user-defined names are withheld from the analytics pipeline). Organization-shared skills and skills delivered by the organization's own plugins (its plugin marketplaces and its library) resolve; plugin skill names are shown without their 'plugin:' prefix. The literal 'unknown' bucket row gets a fixed 'Unknown skill' label. Null for private (user-defined) skills and members' personal-plugin skills — those names are not disclosed to analytics-key holders — and for Anthropic-provided plugin skills (not resolved), and null when `skill_name` is already a display name, when the skill or plugin was deleted, or when display-name resolution is not enabled for this organization.1589015891    - `user_id: optional string or null`1589215893      Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`.1589415895  - `next_page: string or null`1589615897    Opaque cursor for the next page, or null if no more results1589815899#### Example1590015901```bash15902curl https://api.anthropic.com/v1/organizations/analytics/skills \15903    -H 'anthropic-version: 2023-06-01' \15904    -H "X-Api-Key: $ANTHROPIC_API_KEY"15905```1590615907##### Response (200)1590815909```json15910{15911  "data": [15912    {15913      "chat_metrics": {15914        "distinct_conversation_skill_used_count": 015915      },15916      "claude_code_metrics": {15917        "distinct_session_skill_used_count": 015918      },15919      "cowork_metrics": {15920        "distinct_session_skill_used_count": 015921      },15922      "distinct_user_count": 0,15923      "office_metrics": {15924        "excel": {15925          "distinct_session_skill_used_count": 015926        },15927        "outlook": {15928          "distinct_session_skill_used_count": 015929        },15930        "powerpoint": {15931          "distinct_session_skill_used_count": 015932        },15933        "word": {15934          "distinct_session_skill_used_count": 015935        }15936      },15937      "skill_name": "skill_name",15938      "attributed_list_price": "attributed_list_price",15939      "currency": "USD",15940      "enable_count": 0,15941      "estimated_overage_spend": "estimated_overage_spend",15942      "invocation_count": 0,15943      "product": "product",15944      "rbac_group_id": "rbac_group_id",15945      "rbac_group_name": "rbac_group_name",15946      "share_status": "organization",15947      "skill_display_name": "skill_display_name",15948      "user_id": "user_id"15949    }15950  ],15951  "next_page": "next_page"15952}15953```1595415955## Organization › Analytics › Connectors1595615957### Get Connector Usage1595815959**GET** `/v1/organizations/analytics/connectors`1596015961Get per-connector usage for a given day, with cursor-based pagination.1596215963Returns connector usage metrics for the organization, sorted by connector15964name. Connector names are normalized from their various sources — for15965example, "Atlassian MCP server" and "mcp-atlassian" both appear as15966"atlassian". Use `group_by[]` to break usage out per member, per RBAC15967group, or per product surface, and `filter[]` to scope results; the15968parameter descriptions list the supported dimensions. Available to15969organizations on a Claude Enterprise plan. Requires an API key with the15970`read:analytics` scope.1597115972#### Query parameters1597315974- `date: optional string`1597515976  UTC date in YYYY-MM-DD format. The day to get connector usage for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.1597715978  format: date1597915980- `ending_date: optional string`1598115982  UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`.1598315984  format: date1598515986- `filter: optional array of string`1598715988  Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `connector_name`, `product`, `rbac_group_id`, `user_id`. Value forms: `connector_name` matches case-insensitively, a display name such as 'GitHub MCP' also matches its normalized stored form ('github'), and for rows whose `connector_name` is an opaque connector id the connector's display name (`connector_display_name`) also matches; `product` is one of `chat`, `claude_code`, `cowork`, or `office_agent`; `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries.1598915990  maxItems: 1001599115992- `group_by: optional array of "product" or "rbac_group_id" or "user_id"`1599315994  Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `product`, `rbac_group_id`, `user_id`. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries.1599515996  maxItems: 1001599715998  - `"product"`1599916000  - `"rbac_group_id"`1600116002  - `"user_id"`1600316004- `limit: optional number`1600516006  Number of results per page (1-1000, default 100).1600716008  minimum: 1, maximum: 10001600916010- `order: optional "asc" or "desc"`1601116012  Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted.1601316014  - `"asc"`1601516016  - `"desc"`1601716018- `order_by: optional string`1601916020  Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set).1602116022- `page: optional string`1602316024  Opaque cursor from a previous response's `next_page` field.1602516026- `starting_date: optional string`1602716028  UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.1602916030  format: date1603116032#### Returns1603316034- `BetaConnectorUsage object`1603516036  Response for GET /v1/organizations/analytics/connectors.1603716038  - `data: array of object`1603916040    - `chat_metrics: object`1604116042      Claude.ai activity metrics for a single connector on a given day.1604316044      - `distinct_conversation_connector_used_count: number or null`1604516046        Number of distinct conversations in which the connector was used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1604716048    - `claude_code_metrics: object`1604916050      Claude Code activity metrics for a single connector on a given day.1605116052      - `distinct_session_connector_used_count: number or null`1605316054        Number of distinct Claude Code sessions in which the connector was used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1605516056    - `connector_name: string`1605716058      Name of the connector. Some rows carry an opaque connector id here instead of a readable name; `connector_display_name` holds the resolved name for those rows.1605916060    - `cowork_metrics: object`1606116062      Cowork activity metrics for a single connector on a given day.1606316064      - `distinct_session_connector_used_count: number or null`1606516066        Number of distinct Cowork sessions in which the connector was used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1606716068    - `distinct_user_count: number`1606916070      Number of distinct users who used the connector on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values.1607116072    - `office_metrics: object`1607316074      Office Agent activity metrics for a single connector on a given day, broken out by Office product.1607516076      - `excel: BetaConnectorOfficeProductMetrics`1607716078        Office Agent activity metrics for a single connector on a given day within one Office product.1607916080        - `distinct_session_connector_used_count: number or null`1608116082          Number of distinct Office Agent sessions in which the connector was used. Approximate (HLL, typical error <2%) in date-range mode. Null on aggregated rows where a distinct count cannot be computed.1608316084      - `outlook: BetaConnectorOfficeProductMetrics`1608516086        Office Agent activity metrics for a single connector on a given day within one Office product.1608716088      - `powerpoint: BetaConnectorOfficeProductMetrics`1608916090        Office Agent activity metrics for a single connector on a given day within one Office product.1609116092      - `word: BetaConnectorOfficeProductMetrics`1609316094        Office Agent activity metrics for a single connector on a given day within one Office product.1609516096    - `connector_display_name: optional string or null`1609716098      Human-readable display name for rows whose `connector_name` is an opaque connector id rather than a readable name, resolved at request time from the organization's connectors (including connectors that have since been removed). `connector_name` remains the row's stable key for sorting and pagination, and `filter[]=connector_name:{value}` also matches these rows by display name. Display names are not unique, and the same connector's claude.ai usage can appear under a separate row with a readable `connector_name`. Null when `connector_name` is already a readable name, when the id cannot be resolved to one of the organization's connectors, or when display-name resolution is not enabled for this organization.1609916100    - `individual_auth_distinct_user_count: optional number or null`1610116102      Number of distinct users whose use of this connector on the requested day ran on their own individual credential, connected through their own consent flow. Companion bucket to `managed_auth_distinct_user_count`, which carries the measurement, attribution, and null rules. Users whose requests used no stored credential count in neither bucket.1610316104    - `managed_auth_distinct_user_count: optional number or null`1610516106      Number of distinct users whose use of this connector on the requested day ran on Enterprise Managed Auth (an organization-managed credential provisioned through the organization's identity provider), read from the token record each request used. Null, never 0, when managed-auth reporting is not enabled for the organization, the value cannot be attributed to the row, no credentialed requests and no managed-token mint events (a managed credential being provisioned for a user's use of the connector) were observed that day, or the day predates 2026-07-01, the first day the backing data exists (forward-only data, no backfill). When credentialed requests or mint events were observed and attributed, both managed-auth fields populate, reporting 0 for a bucket with no users; the two counts are independent, not a partition — a user whose requests that day used both kinds of credential counts in both. Mint events carry user but not surface attribution, so they count as observed auth activity on `user_id` and `rbac_group_id` cuts — attributed to the user the credential was provisioned for — but never on a cut that references `product` (group or filter). Date-range rollup mode (`starting_date`/`ending_date`) computes both fields exactly over the window — distinct users with at least one qualifying day — when the whole window starts on or after 2026-07-01, with the null-versus-0 and mint-event rules applying with the window in place of the day; a range starting earlier reports every managed-auth field as null, never a partial-window value.1610716108    - `product: optional string or null`1610916110      Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, or `office_agent` (the canonical Cost & Usage product naming; an `office_agent` row's per-surface breakdown is in its `office_metrics`). On `/plugins` only `cowork` and `claude_code` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, and `cowork` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`.1611116112    - `rbac_group_id: optional string or null`1611316114      Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`.1611516116    - `rbac_group_name: optional string or null`1611716118      Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key.1611916120    - `read_call_count: optional number or null`1612116122      Number of connector tool calls on the requested day whose trusted read-only annotation marked them read-only. Call count, not distinct users. Every call recorded on a classified surface lands in exactly one of `read_call_count`, `write_call_count`, or `unclassified_call_count`, so the three sum to the day's classified calls. Classification is forward-only per surface: claude.ai from 2026-06-01, Claude Code from 2026-05-30, Claude in Office from 2026-05-29, Cowork from 2026-06-02 (Cowork clients predating annotation forwarding land in `unclassified_call_count`). Null, never 0, when the value cannot be stated: the read/write split is not enabled for this organization, or the day predates 2026-05-29. For a date-range total, sum the per-day values, but treat a window that extends before 2026-05-29 as null rather than summing only its covered days — date-range rollup mode (`starting_date`/`ending_date`) applies both rules server-side.1612316124    - `unclassified_call_count: optional number or null`1612516126      Number of connector tool calls on the requested day with no trusted read-only annotation — the annotation is optional in the MCP spec and is discarded when connector access controls are active, so unclassified calls are common. This field shows how much of the day's classified activity the read/write split actually covers. Call count, not distinct users. One of the three call-classification buckets; see `read_call_count` for the per-surface data-start dates, null conditions, and date-range guidance.1612716128    - `user_id: optional string or null`1612916130      Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`.1613116132    - `write_call_count: optional number or null`1613316134      Number of connector tool calls on the requested day whose trusted read-only annotation marked them not read-only. Call count, not distinct users. One of the three call-classification buckets; see `read_call_count` for the per-surface data-start dates, null conditions, and date-range guidance.1613516136  - `next_page: string or null`1613716138    Opaque cursor for the next page, or null if no more results1613916140#### Example1614116142```bash16143curl https://api.anthropic.com/v1/organizations/analytics/connectors \16144    -H 'anthropic-version: 2023-06-01' \16145    -H "X-Api-Key: $ANTHROPIC_API_KEY"16146```1614716148##### Response (200)1614916150```json16151{16152  "data": [16153    {16154      "chat_metrics": {16155        "distinct_conversation_connector_used_count": 016156      },16157      "claude_code_metrics": {16158        "distinct_session_connector_used_count": 016159      },16160      "connector_name": "connector_name",16161      "cowork_metrics": {16162        "distinct_session_connector_used_count": 016163      },16164      "distinct_user_count": 0,16165      "office_metrics": {16166        "excel": {16167          "distinct_session_connector_used_count": 016168        },16169        "outlook": {16170          "distinct_session_connector_used_count": 016171        },16172        "powerpoint": {16173          "distinct_session_connector_used_count": 016174        },16175        "word": {16176          "distinct_session_connector_used_count": 016177        }16178      },16179      "connector_display_name": "connector_display_name",16180      "individual_auth_distinct_user_count": 0,16181      "managed_auth_distinct_user_count": 0,16182      "product": "product",16183      "rbac_group_id": "rbac_group_id",16184      "rbac_group_name": "rbac_group_name",16185      "read_call_count": 0,16186      "unclassified_call_count": 0,16187      "user_id": "user_id",16188      "write_call_count": 016189    }16190  ],16191  "next_page": "next_page"16192}16193```1619416195## Organization › Analytics › Chat Projects1619616197### Get Chat Project Usage1619816199**GET** `/v1/organizations/analytics/apps/chat/projects`1620016201Get per-project activity for a given day, with cursor-based pagination.1620216203Returns activity metrics for each project in the organization, sorted by16204project ID. Use `group_by[]` to break projects out per member or per RBAC16205group, and `filter[]` to scope results; the parameter descriptions list the16206supported dimensions. Available to organizations on a Claude Enterprise16207plan. Requires an API key with the `read:analytics` scope.1620816209#### Query parameters1621016211- `date: optional string`1621216213  UTC date in YYYY-MM-DD format. The day to get project activity for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.1621416215  format: date1621616217- `ending_date: optional string`1621816219  UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`.1622016221  format: date1622216223- `filter: optional array of string`1622416225  Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `project_id`, `rbac_group_id`, `user_id`. Value forms: `project_id` takes a tagged project id (`claude_proj_...`); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries.1622616227  maxItems: 1001622816229- `group_by: optional array of "rbac_group_id" or "user_id"`1623016231  Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `rbac_group_id`, `user_id`. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries.1623216233  maxItems: 1001623416235  - `"rbac_group_id"`1623616237  - `"user_id"`1623816239- `limit: optional number`1624016241  Number of results per page (1-1000, default 100).1624216243  minimum: 1, maximum: 10001624416245- `order: optional "asc" or "desc"`1624616247  Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted.1624816249  - `"asc"`1625016251  - `"desc"`1625216253- `order_by: optional string`1625416255  Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set).1625616257- `page: optional string`1625816259  Opaque cursor from a previous response's `next_page` field.1626016261- `starting_date: optional string`1626216263  UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.1626416265  format: date1626616267#### Returns1626816269- `BetaChatProjectUsage object`1627016271  Response for GET /v1/organizations/analytics/apps/chat/projects.1627216273  - `data: array of object`1627416275    - `distinct_user_count: number`1627616277      Number of distinct users who used the project on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values.1627816279    - `message_count: number`1628016281      Number of messages sent in the project on the requested day1628216283    - `project_id: string`1628416285      Tagged project identifier (e.g. `claude_proj_...`)1628616287    - `project_name: string`1628816289      Name of the project1629016291    - `created_at: optional string or null`1629216293      Project creation timestamp in RFC 3339 format. Null if the project was deleted before attribution was recorded.1629416295      format: date-time1629616297    - `created_by: optional BetaAnalyticsUser or null`1629816299      A user in the organization, identified by tagged id and email address.1630016301      - `type: "user"`1630216303        Object type. Always `user`.1630416305        default: user1630616307      - `id: string`1630816309        Tagged user identifier (e.g. `user_...`)1631016311      - `email_address: string`1631216313        Email address of the user1631416315    - `distinct_conversation_count: optional number or null`1631616317      Number of distinct conversations in the project. Null on aggregated rows where a distinct count cannot be computed.1631816319    - `product: optional string or null`1632016321      Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, or `office_agent` (the canonical Cost & Usage product naming; an `office_agent` row's per-surface breakdown is in its `office_metrics`). On `/plugins` only `cowork` and `claude_code` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, and `cowork` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`.1632216323    - `rbac_group_id: optional string or null`1632416325      Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`.1632616327    - `rbac_group_name: optional string or null`1632816329      Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key.1633016331    - `user_id: optional string or null`1633216333      Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`.1633416335  - `next_page: string or null`1633616337    Opaque cursor for the next page, or null if no more results1633816339#### Example1634016341```bash16342curl https://api.anthropic.com/v1/organizations/analytics/apps/chat/projects \16343    -H 'anthropic-version: 2023-06-01' \16344    -H "X-Api-Key: $ANTHROPIC_API_KEY"16345```1634616347##### Response (200)1634816349```json16350{16351  "data": [16352    {16353      "distinct_user_count": 0,16354      "message_count": 0,16355      "project_id": "project_id",16356      "project_name": "project_name",16357      "created_at": "2019-12-27T18:11:19.117Z",16358      "created_by": {16359        "id": "id",16360        "email_address": "email_address",16361        "type": "user"16362      },16363      "distinct_conversation_count": 0,16364      "product": "product",16365      "rbac_group_id": "rbac_group_id",16366      "rbac_group_name": "rbac_group_name",16367      "user_id": "user_id"16368    }16369  ],16370  "next_page": "next_page"16371}16372```1637316374## Organization › Analytics › Plugins1637516376### Get Plugin Usage1637716378**GET** `/v1/organizations/analytics/plugins`1637916380Get per-plugin install + invocation usage for a given day, with pagination.1638116382Returns plugin usage metrics for the organization across Cowork and Claude16383Code, sorted by plugin name. The `plugin_name` value `third-party` is16384an aggregate bucket, not a plugin: it collects plugin activity, from16385either surface, for which the reporting client did not provide a plugin16386name — so an organization's own plugins can contribute both to their own16387named rows and to this bucket. Use `group_by[]` to break usage out per16388member, per RBAC group, or per product surface (Cowork / Claude Code),16389and `filter[]` to scope results; the parameter descriptions list the16390supported dimensions. Requires an API key with the16391`read:analytics` scope. `starting_date` / `ending_date` select16392range-rollup mode like `/skills`.1639316394#### Query parameters1639516396- `date: optional string`1639716398  UTC date in YYYY-MM-DD format. The day to get plugin usage for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.1639916400  format: date1640116402- `ending_date: optional string`1640316404  UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`.1640516406  format: date1640716408- `filter: optional array of string`1640916410  Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `plugin_name`, `product`, `rbac_group_id`, `user_id`. Value forms: `plugin_name` matches case-insensitively; `product` is `claude_code` or `cowork` (the only surfaces with plugin attribution); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries.1641116412  maxItems: 1001641316414- `group_by: optional array of "product" or "rbac_group_id" or "user_id"`1641516416  Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `product`, `rbac_group_id`, `user_id`. On this endpoint `product` takes the values `claude_code` or `cowork` only (the surfaces with plugin attribution). Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries.1641716418  maxItems: 1001641916420  - `"product"`1642116422  - `"rbac_group_id"`1642316424  - `"user_id"`1642516426- `limit: optional number`1642716428  Number of results per page (1-1000, default 100).1642916430  minimum: 1, maximum: 10001643116432- `order: optional "asc" or "desc"`1643316434  Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted.1643516436  - `"asc"`1643716438  - `"desc"`1643916440- `order_by: optional string`1644116442  Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set).1644316444- `page: optional string`1644516446  Opaque cursor from a previous response's `next_page` field.1644716448- `starting_date: optional string`1644916450  UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.1645116452  format: date1645316454#### Returns1645516456- `BetaPluginUsage object`1645716458  Response for GET /v1/organizations/analytics/plugins.1645916460  - `data: array of object`1646116462    - `claude_code_metrics: object`1646316464      Claude Code activity metrics for a single plugin on a given day.1646516466      - `distinct_session_plugin_used_count: number or null`1646716468        Number of distinct Claude Code sessions in which the plugin was invoked. Null on aggregated rows where a distinct count cannot be computed.1646916470    - `cowork_metrics: object`1647116472      Cowork activity metrics for a single plugin on a given day.1647316474      - `distinct_session_plugin_used_count: number or null`1647516476        Number of distinct Cowork sessions in which the plugin was invoked. Null on aggregated rows where a distinct count cannot be computed.1647716478    - `distinct_user_count: number`1647916480      Number of distinct users with recorded install or invocation activity for the plugin on the requested day (install-only users count), or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values.1648116482    - `install_count: number or null`1648316484      Number of distinct users who installed the plugin on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values.1648516486    - `invocation_count: number`1648716488      Number of plugin invocations on the requested day1648916490    - `plugin_name: string`1649116492      Name of the plugin1649316494    - `plugin_id: optional string or null`1649516496      Stable plugin identifier when available (e.g. `serena@claude-plugins-official`). Null for third-party Claude Code plugins (redacted at the source) and Cowork slash commands that carry only a hashed id.1649716498    - `product: optional string or null`1649916500      Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, or `office_agent` (the canonical Cost & Usage product naming; an `office_agent` row's per-surface breakdown is in its `office_metrics`). On `/plugins` only `cowork` and `claude_code` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, and `cowork` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`.1650116502    - `rbac_group_id: optional string or null`1650316504      Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`.1650516506    - `rbac_group_name: optional string or null`1650716508      Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key.1650916510    - `user_id: optional string or null`1651116512      Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`.1651316514  - `next_page: string or null`1651516516    Opaque cursor for the next page, or null if no more results1651716518#### Example1651916520```bash16521curl https://api.anthropic.com/v1/organizations/analytics/plugins \16522    -H 'anthropic-version: 2023-06-01' \16523    -H "X-Api-Key: $ANTHROPIC_API_KEY"16524```1652516526##### Response (200)1652716528```json16529{16530  "data": [16531    {16532      "claude_code_metrics": {16533        "distinct_session_plugin_used_count": 016534      },16535      "cowork_metrics": {16536        "distinct_session_plugin_used_count": 016537      },16538      "distinct_user_count": 0,16539      "install_count": 0,16540      "invocation_count": 0,16541      "plugin_name": "plugin_name",16542      "plugin_id": "plugin_id",16543      "product": "product",16544      "rbac_group_id": "rbac_group_id",16545      "rbac_group_name": "rbac_group_name",16546      "user_id": "user_id"16547    }16548  ],16549  "next_page": "next_page"16550}16551```1655216553## Organization › Analytics › Artifacts1655416555### Get Artifact Activity1655616557**GET** `/v1/organizations/analytics/artifacts`1655816559Get artifact-creation activity for a given day, broken out by MIME type.1656016561Returns the full (`artifact_type`, `is_shared`) cube for the organization;16562`next_page` is null except for grouped queries, which paginate. The cube16563can be broken out per product, per member, or per RBAC group via16564`group_by[]`, and scoped via `filter[]`. Requires an API key with the16565`read:analytics` scope.1656616567#### Query parameters1656816569- `date: string`1657016571  UTC date in YYYY-MM-DD format. The day to get artifact activity for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.1657216573  format: date1657416575- `filter: optional array of string`1657616577  Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `artifact_type`, `is_shared`, `product`, `rbac_group_id`, `user_id`. Value forms: `artifact_type` is a canonical artifact MIME type (e.g. `text/markdown`) or `other`; `is_shared` is `true` or `false`; `product` is `chat`, `claude_code`, or `cowork` (the surfaces that create artifacts); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries.1657816579  maxItems: 1001658016581- `group_by: optional array of "product" or "rbac_group_id" or "user_id"`1658216583  Dimensions to break results out by: `product`, `user_id` and/or `rbac_group_id`. The ungrouped artifact-type cube is finite and returned in full; grouped queries multiply the cube and paginate via `next_page`. `product` takes the values `chat`, `claude_code`, or `cowork` (the surfaces that create artifacts). `rbac_group_id` attributes a user to every group they held at any point during the requested UTC day, so grouped rows are not an exclusive partition. At most 100 entries.1658416585  maxItems: 1001658616587  - `"product"`1658816589  - `"rbac_group_id"`1659016591  - `"user_id"`1659216593- `limit: optional number`1659416595  Maximum rows to return (1-1000, default 100). The ungrouped artifact-type cube is finite and returned in full; `limit` is the page size only when `group_by[]` multiplies the cube.1659616597  minimum: 1, maximum: 10001659816599- `page: optional string`1660016601  Opaque cursor from a previous response's `next_page` field. Only valid with `group_by[]` — the ungrouped cube is never paginated.1660216603#### Returns1660416605- `BetaArtifactUsage object`1660616607  Response for GET /v1/organizations/analytics/artifacts.1660816609  `next_page` is null on ungrouped queries — the artifact-type cube is16610  finite and returned in full. Grouped queries (`group_by[]` on `product` /16611  `user_id` / `rbac_group_id`) multiply the cube and paginate like the other16612  analytics list endpoints.1661316614  - `data: array of object`1661516616    - `artifact_type: string`1661716618      Canonical artifact MIME type (e.g. `text/markdown`, `application/vnd.ant.react`, `image/svg+xml`), or `other`. Claude Code and Cowork artifacts report as `text/html`.1661916620    - `artifacts_created_count: number`1662116622      Number of artifacts created in this bucket on the requested day1662316624    - `distinct_user_count: number`1662516626      Number of distinct users who created artifacts in this bucket on the requested day1662716628    - `is_shared: boolean`1662916630      Whether the artifacts in this bucket have ever been shared (a Claude Code / Cowork artifact is shared once anyone beyond its creator may open it: named members, the whole organization, or anyone with the link).1663116632    - `published_artifacts_created_count: number`1663316634      Number of those artifacts that have been published (for Claude Code / Cowork artifacts: open to anyone with the link); never exceeds `artifacts_created_count`1663516636    - `product: optional string or null`1663716638      Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, or `office_agent` (the canonical Cost & Usage product naming; an `office_agent` row's per-surface breakdown is in its `office_metrics`). On `/plugins` only `cowork` and `claude_code` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, and `cowork` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`.1663916640    - `rbac_group_id: optional string or null`1664116642      Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`.1664316644    - `rbac_group_name: optional string or null`1664516646      Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key.1664716648    - `user_id: optional string or null`1664916650      Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`.1665116652  - `next_page: string or null`1665316654    Cursor for the next page of a grouped query; always null for the ungrouped artifact-type cube, which is returned in full.1665516656#### Example1665716658```bash16659curl https://api.anthropic.com/v1/organizations/analytics/artifacts \16660    -H 'anthropic-version: 2023-06-01' \16661    -H "X-Api-Key: $ANTHROPIC_API_KEY"16662```1666316664##### Response (200)1666516666```json16667{16668  "data": [16669    {16670      "artifact_type": "artifact_type",16671      "artifacts_created_count": 0,16672      "distinct_user_count": 0,16673      "is_shared": true,16674      "published_artifacts_created_count": 0,16675      "product": "product",16676      "rbac_group_id": "rbac_group_id",16677      "rbac_group_name": "rbac_group_name",16678      "user_id": "user_id"16679    }16680  ],16681  "next_page": "next_page"16682}16683```1668416685## Organization › Spend Limits1668616687### Set Spend Limit1668816689**POST** `/v1/organizations/spend_limits`1669016691Set a spend limit.1669216693Upsert keyed on (scope, period): setting a limit that already exists16694overwrites it in place. A Claude Enterprise organization sets `user`16695limits. Its seat-tier, group, and organization-level defaults are configured16696in claude.ai. A Claude Console organization sets `organization` and16697`workspace` limits, which are monthly and always carry an amount. Setting those16698limits is in an early access preview. To request access, contact your16699Anthropic account team.1670016701#### Body parameters1670216703- `amount: string or null`1670416705  Limit amount as a non-negative integer decimal string in the minor unit of the organization's billing currency (cents for USD): "50000" is $500.00. `null` sets an explicit no-limit override for this scope and `period` only — each period resolves independently, so caps for other periods still apply.1670616707- `scope: User or Organization or Workspace`1670816709  What the limit applies to. Claude Enterprise organizations set `user` limits. Claude Console organizations set `organization` and `workspace` limits. Any other combination returns 400. Setting `organization` and `workspace` limits through the API is in an early access preview. To request access, contact your Anthropic account team.1671016711  - `User object`1671216713    Scope selecting a single member of the organization.1671416715    - `type: "user"`1671616717      Scope type. Always `user` for this scope.1671816719      default: user1672016721    - `user_id: string`1672216723      Tagged ID of the member the spend limit applies to.1672416725  - `Organization object`1672616727    - `type: "organization"`1672816729      default: organization1673016731  - `Workspace object`1673216733    Scope selecting one workspace of a Claude Console organization.1673416735    - `type: "workspace"`1673616737      Scope type. Always `workspace` for this scope.1673816739      default: workspace1674016741    - `workspace_id: string`1674216743      Tagged ID of the workspace the spend limit applies to.1674416745- `period: optional "daily" or "monthly" or "weekly"`1674616747  - `"daily"`1674816749  - `"monthly"`1675016751  - `"weekly"`1675216753#### Returns1675416755- `BetaSpendLimit object`1675616757  A configured spend limit: a cap on metered spend for one scope and period.1675816759  - `type: "spend_limit"`1676016761    Object type. Always `spend_limit`.1676216763    default: spend_limit1676416765  - `id: string`1676616767    Unique tagged ID of the spend limit (`spl_...`).1676816769  - `amount: string or null`1677016771    Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies.1677216773  - `created_at: string`1677416775    RFC 3339 datetime at which the spend limit was created.1677616777    format: date-time1677816779  - `currency: string`1678016781    ISO 4217 code of the organization's billing currency; the unit for `amount`.1678216783  - `period: "daily" or "monthly" or "weekly"`1678416785    Length of the window the limit resets over. `amount` caps spend within each period.1678616787    - `"daily"`1678816789    - `"monthly"`1679016791    - `"weekly"`1679216793  - `scope: User or SeatTier or RBACGroup or 3 more`1679416795    What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.1679616797    - `User object`1679816799      Scope selecting a single member of the organization.1680016801      - `type: "user"`1680216803        Scope type. Always `user` for this scope.1680416805        default: user1680616807      - `user_id: string`1680816809        Tagged ID of the member the spend limit applies to.1681016811    - `SeatTier object`1681216813      - `type: "seat_tier"`1681416815        default: seat_tier1681616817      - `seat_tier: string`1681816819    - `RBACGroup object`1682016821      - `type: "rbac_group"`1682216823        default: rbac_group1682416825      - `rbac_group_id: string`1682616827    - `OrganizationService object`1682816829      - `type: "organization_service"`1683016831        default: organization_service1683216833      - `service: string`1683416835    - `Organization object`1683616837      - `type: "organization"`1683816839        default: organization1684016841    - `Workspace object`1684216843      Scope selecting one workspace of a Claude Console organization.1684416845      - `type: "workspace"`1684616847        Scope type. Always `workspace` for this scope.1684816849        default: workspace1685016851      - `workspace_id: string`1685216853        Tagged ID of the workspace the spend limit applies to.1685416855  - `updated_at: string`1685616857    RFC 3339 datetime at which the spend limit was last modified.1685816859    format: date-time1686016861#### Example1686216863```bash16864curl https://api.anthropic.com/v1/organizations/spend_limits \16865    -H 'Content-Type: application/json' \16866    -H 'anthropic-version: 2023-06-01' \16867    -H "X-Api-Key: $ANTHROPIC_API_KEY" \16868    -d '{16869          "amount": "50000",16870          "scope": {16871            "type": "user",16872            "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"16873          },16874          "period": "monthly"16875        }'16876```1687716878##### Response (200)1687916880```json16881{16882  "id": "id",16883  "amount": "50000",16884  "created_at": "2019-12-27T18:11:19.117Z",16885  "currency": "USD",16886  "period": "monthly",16887  "scope": {16888    "type": "user",16889    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"16890  },16891  "type": "spend_limit",16892  "updated_at": "2019-12-27T18:11:19.117Z"16893}16894```1689516896### Get Spend Limit1689716898**GET** `/v1/organizations/spend_limits/{spend_limit_id}`1689916900Retrieve a spend limit by ID.1690116902#### Path parameters1690316904- `spend_limit_id: string`1690516906  ID of the Spend Limit.1690716908#### Returns1690916910- `BetaSpendLimit object`1691116912  A configured spend limit: a cap on metered spend for one scope and period.1691316914  - `type: "spend_limit"`1691516916    Object type. Always `spend_limit`.1691716918    default: spend_limit1691916920  - `id: string`1692116922    Unique tagged ID of the spend limit (`spl_...`).1692316924  - `amount: string or null`1692516926    Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies.1692716928  - `created_at: string`1692916930    RFC 3339 datetime at which the spend limit was created.1693116932    format: date-time1693316934  - `currency: string`1693516936    ISO 4217 code of the organization's billing currency; the unit for `amount`.1693716938  - `period: "daily" or "monthly" or "weekly"`1693916940    Length of the window the limit resets over. `amount` caps spend within each period.1694116942    - `"daily"`1694316944    - `"monthly"`1694516946    - `"weekly"`1694716948  - `scope: User or SeatTier or RBACGroup or 3 more`1694916950    What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.1695116952    - `User object`1695316954      Scope selecting a single member of the organization.1695516956      - `type: "user"`1695716958        Scope type. Always `user` for this scope.1695916960        default: user1696116962      - `user_id: string`1696316964        Tagged ID of the member the spend limit applies to.1696516966    - `SeatTier object`1696716968      - `type: "seat_tier"`1696916970        default: seat_tier1697116972      - `seat_tier: string`1697316974    - `RBACGroup object`1697516976      - `type: "rbac_group"`1697716978        default: rbac_group1697916980      - `rbac_group_id: string`1698116982    - `OrganizationService object`1698316984      - `type: "organization_service"`1698516986        default: organization_service1698716988      - `service: string`1698916990    - `Organization object`1699116992      - `type: "organization"`1699316994        default: organization1699516996    - `Workspace object`1699716998      Scope selecting one workspace of a Claude Console organization.1699917000      - `type: "workspace"`1700117002        Scope type. Always `workspace` for this scope.1700317004        default: workspace1700517006      - `workspace_id: string`1700717008        Tagged ID of the workspace the spend limit applies to.1700917010  - `updated_at: string`1701117012    RFC 3339 datetime at which the spend limit was last modified.1701317014    format: date-time1701517016#### Example1701717018```bash17019curl https://api.anthropic.com/v1/organizations/spend_limits/$SPEND_LIMIT_ID \17020    -H 'anthropic-version: 2023-06-01' \17021    -H "X-Api-Key: $ANTHROPIC_API_KEY"17022```1702317024##### Response (200)1702517026```json17027{17028  "id": "id",17029  "amount": "50000",17030  "created_at": "2019-12-27T18:11:19.117Z",17031  "currency": "USD",17032  "period": "monthly",17033  "scope": {17034    "type": "user",17035    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"17036  },17037  "type": "spend_limit",17038  "updated_at": "2019-12-27T18:11:19.117Z"17039}17040```1704117042### Delete Spend Limit1704317044**DELETE** `/v1/organizations/spend_limits/{spend_limit_id}`1704517046Delete a spend limit.1704717048For a Claude Enterprise organization, this deletes a per-user override, and17049the member falls back to any inherited spend limit at that period. Its17050seat-tier, group, and organization-level rows cannot be deleted via this17051endpoint. A Claude Console organization deletes its organization and17052workspace limits. Deleting them through the API is in an early access preview.1705317054#### Path parameters1705517056- `spend_limit_id: string`1705717058  ID of the Spend Limit.1705917060#### Returns1706117062- `type: "spend_limit_deleted"`1706317064  default: spend_limit_deleted1706517066- `id: string`1706717068#### Example1706917070```bash17071curl https://api.anthropic.com/v1/organizations/spend_limits/$SPEND_LIMIT_ID \17072    -X DELETE \17073    -H 'anthropic-version: 2023-06-01' \17074    -H "X-Api-Key: $ANTHROPIC_API_KEY"17075```1707617077##### Response (200)1707817079```json17080{17081  "id": "id",17082  "type": "spend_limit_deleted"17083}17084```1708517086### List Effective Spend Limits1708717088**GET** `/v1/organizations/spend_limits/effective`1708917090List each member's effective spend limit and period-to-date spend.1709117092Returns one row per (member, period) the member resolves a spend limit17093for, with the `source` scope the spend limit was inherited from.17094Paginates by member, so a member's periods never split across pages.1709517096#### Query parameters1709717098- `limit: optional number`1709917100  Maximum number of members per page. A member's period rows never split across pages, so a page may carry more rows than this. Defaults to `20`.1710117102  default: 20, maximum: 1000, minimum: 11710317104- `page: optional string`1710517106  Opaque cursor from a previous response's `next_page` field.1710717108- `period: optional array of "daily" or "monthly" or "weekly"`1710917110  Restrict the report to these limit periods. Omit to return one row per period each member resolves a spend limit for.1711117112  maxItems: 31711317114  - `"daily"`1711517116  - `"monthly"`1711717118  - `"weekly"`1711917120- `user_ids: optional array of string`1712117122  Restrict the report to these members, by tagged user ID (`user_...`). At most 100 entries.1712317124  maxItems: 1001712517126#### Returns1712717128- `data: array of BetaSpendSummary`1712917130  - `actor: UserActor or ScopedAPIKeyActor`1713117132    - `UserActor object`1713317134      A user within the organization. `name` and `email_address` are17135      null when the underlying account is unavailable or has been deleted;17136      `deleted` is true only for deleted accounts.1713717138      - `type: "user_actor"`1713917140        Actor type. Always `user_actor`.1714117142        default: user_actor1714317144      - `deleted: boolean`1714517146        True only when the underlying account has been deleted.1714717148        default: false1714917150      - `email_address: string or null`1715117152        The user's email address. Null when the account is unavailable or has been deleted.1715317154      - `name: string or null`1715517156        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.1715717158      - `user_id: string`1715917160        Tagged ID of the user.1716117162    - `ScopedAPIKeyActor object`1716317164      A scoped Admin API key acting on behalf of the organization.1716517166      - `type: "scoped_api_key_actor"`1716717168        default: scoped_api_key_actor1716917170      - `scoped_api_key_id: string`1717117172  - `amount: string or null`1717317174    Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.1717517176  - `currency: string`1717717178    ISO 4217 code of the organization's billing currency; the unit for `amount` and `period_to_date_spend`.1717917180  - `period: "daily" or "monthly" or "weekly"`1718117182    Period this row's effective limit and spend are reported for.1718317184    - `"daily"`1718517186    - `"monthly"`1718717188    - `"weekly"`1718917190  - `period_to_date_spend: string`1719117192    The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.1719317194  - `scope: User or SeatTier or RBACGroup or 3 more`1719517196    - `User object`1719717198      Scope selecting a single member of the organization.1719917200      - `type: "user"`1720117202        Scope type. Always `user` for this scope.1720317204        default: user1720517206      - `user_id: string`1720717208        Tagged ID of the member the spend limit applies to.1720917210    - `SeatTier object`1721117212      - `type: "seat_tier"`1721317214        default: seat_tier1721517216      - `seat_tier: string`1721717218    - `RBACGroup object`1721917220      - `type: "rbac_group"`1722117222        default: rbac_group1722317224      - `rbac_group_id: string`1722517226    - `OrganizationService object`1722717228      - `type: "organization_service"`1722917230        default: organization_service1723117232      - `service: string`1723317234    - `Organization object`1723517236      - `type: "organization"`1723717238        default: organization1723917240    - `Workspace object`1724117242      Scope selecting one workspace of a Claude Console organization.1724317244      - `type: "workspace"`1724517246        Scope type. Always `workspace` for this scope.1724717248        default: workspace1724917250      - `workspace_id: string`1725117252        Tagged ID of the workspace the spend limit applies to.1725317254  - `source: User or SeatTier or RBACGroup or 3 more`1725517256    - `User object`1725717258      Scope selecting a single member of the organization.1725917260      - `type: "user"`1726117262        Scope type. Always `user` for this scope.1726317264        default: user1726517266      - `user_id: string`1726717268        Tagged ID of the member the spend limit applies to.1726917270    - `SeatTier object`1727117272      - `type: "seat_tier"`1727317274        default: seat_tier1727517276      - `seat_tier: string`1727717278    - `RBACGroup object`1727917280      - `type: "rbac_group"`1728117282        default: rbac_group1728317284      - `rbac_group_id: string`1728517286    - `OrganizationService object`1728717288      - `type: "organization_service"`1728917290        default: organization_service1729117292      - `service: string`1729317294    - `Organization object`1729517296      - `type: "organization"`1729717298        default: organization1729917300    - `Workspace object`1730117302      Scope selecting one workspace of a Claude Console organization.1730317304      - `type: "workspace"`1730517306        Scope type. Always `workspace` for this scope.1730717308        default: workspace1730917310      - `workspace_id: string`1731117312        Tagged ID of the workspace the spend limit applies to.1731317314  - `spend_limit_id: string`1731517316- `next_page: string or null`1731717318#### Example1731917320```bash17321curl https://api.anthropic.com/v1/organizations/spend_limits/effective \17322    -H 'anthropic-version: 2023-06-01' \17323    -H "X-Api-Key: $ANTHROPIC_API_KEY"17324```1732517326##### Response (200)1732717328```json17329{17330  "data": [17331    {17332      "actor": {17333        "deleted": true,17334        "email_address": "email_address",17335        "name": "name",17336        "type": "user_actor",17337        "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"17338      },17339      "amount": "50000",17340      "currency": "USD",17341      "period": "monthly",17342      "period_to_date_spend": "12050.5",17343      "scope": {17344        "type": "user",17345        "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"17346      },17347      "source": {17348        "type": "user",17349        "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"17350      },17351      "spend_limit_id": "spend_limit_id"17352    }17353  ],17354  "next_page": "next_page"17355}17356```1735717358## Organization › Spend Limits › Increase Requests1735917360### List Spend Limit Increase Requests1736117362**GET** `/v1/organizations/spend_limit_increase_requests`1736317364List spend limit increase requests, most recent first.1736517366Pending requests include a live `spend_summary` for the requester.17367Requests whose requester is no longer a member are excluded.1736817369#### Query parameters1737017371- `actor_ids: optional array of string`1737217373  Filter by requester, as `user_...` tagged IDs.1737417375- `limit: optional number`1737617377  default: 20, maximum: 1000, minimum: 11737817379- `page: optional string`1738017381  Opaque cursor from a previous response's `next_page`.1738217383- `status: optional array of "approved" or "denied" or "pending"`1738417385  Filter by status. Omit to return all.1738617387  - `"approved"`1738817389  - `"denied"`1739017391  - `"pending"`1739217393#### Returns1739417395- `data: array of BetaSpendLimitIncreaseRequest`1739617397  - `type: "spend_limit_increase_request"`1739817399    default: spend_limit_increase_request1740017401  - `id: string`1740217403  - `actor: object`1740417405    A user within the organization. `name` and `email_address` are17406    null when the underlying account is unavailable or has been deleted;17407    `deleted` is true only for deleted accounts.1740817409    - `type: "user_actor"`1741017411      Actor type. Always `user_actor`.1741217413      default: user_actor1741417415    - `deleted: boolean`1741617417      True only when the underlying account has been deleted.1741817419      default: false1742017421    - `email_address: string or null`1742217423      The user's email address. Null when the account is unavailable or has been deleted.1742417425    - `name: string or null`1742617427      The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.1742817429    - `user_id: string`1743017431      Tagged ID of the user.1743217433  - `created_at: string`1743417435    format: date-time1743617437  - `period: "daily" or "monthly" or "weekly"`1743817439    - `"daily"`1744017441    - `"monthly"`1744217443    - `"weekly"`1744417445  - `resolved_at: string or null`1744617447    format: date-time1744817449  - `resolved_by: UserActor or ScopedAPIKeyActor or null`1745017451    - `UserActor object`1745217453      A user within the organization. `name` and `email_address` are17454      null when the underlying account is unavailable or has been deleted;17455      `deleted` is true only for deleted accounts.1745617457      - `type: "user_actor"`1745817459        Actor type. Always `user_actor`.1746017461        default: user_actor1746217463      - `deleted: boolean`1746417465        True only when the underlying account has been deleted.1746617467        default: false1746817469      - `email_address: string or null`1747017471        The user's email address. Null when the account is unavailable or has been deleted.1747217473      - `name: string or null`1747417475        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.1747617477      - `user_id: string`1747817479        Tagged ID of the user.1748017481    - `ScopedAPIKeyActor object`1748217483      A scoped Admin API key acting on behalf of the organization.1748417485      - `type: "scoped_api_key_actor"`1748617487        default: scoped_api_key_actor1748817489      - `scoped_api_key_id: string`1749017491  - `spend_summary: BetaSpendSummary or null`1749217493    Per-member effective-limit report row (`GET /spend_limits/effective`).1749417495    - `actor: UserActor or ScopedAPIKeyActor`1749617497      - `UserActor object`1749817499        A user within the organization. `name` and `email_address` are17500        null when the underlying account is unavailable or has been deleted;17501        `deleted` is true only for deleted accounts.1750217503        - `type: "user_actor"`1750417505          Actor type. Always `user_actor`.1750617507          default: user_actor1750817509        - `deleted: boolean`1751017511          True only when the underlying account has been deleted.1751217513          default: false1751417515        - `email_address: string or null`1751617517          The user's email address. Null when the account is unavailable or has been deleted.1751817519        - `name: string or null`1752017521          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.1752217523        - `user_id: string`1752417525          Tagged ID of the user.1752617527      - `ScopedAPIKeyActor object`1752817529        A scoped Admin API key acting on behalf of the organization.1753017531        - `type: "scoped_api_key_actor"`1753217533          default: scoped_api_key_actor1753417535        - `scoped_api_key_id: string`1753617537    - `amount: string or null`1753817539      Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.1754017541    - `currency: string`1754217543      ISO 4217 code of the organization's billing currency; the unit for `amount` and `period_to_date_spend`.1754417545    - `period: "daily" or "monthly" or "weekly"`1754617547      Period this row's effective limit and spend are reported for.1754817549      - `"daily"`1755017551      - `"monthly"`1755217553      - `"weekly"`1755417555    - `period_to_date_spend: string`1755617557      The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.1755817559    - `scope: User or SeatTier or RBACGroup or 3 more`1756017561      - `User object`1756217563        Scope selecting a single member of the organization.1756417565        - `type: "user"`1756617567          Scope type. Always `user` for this scope.1756817569          default: user1757017571        - `user_id: string`1757217573          Tagged ID of the member the spend limit applies to.1757417575      - `SeatTier object`1757617577        - `type: "seat_tier"`1757817579          default: seat_tier1758017581        - `seat_tier: string`1758217583      - `RBACGroup object`1758417585        - `type: "rbac_group"`1758617587          default: rbac_group1758817589        - `rbac_group_id: string`1759017591      - `OrganizationService object`1759217593        - `type: "organization_service"`1759417595          default: organization_service1759617597        - `service: string`1759817599      - `Organization object`1760017601        - `type: "organization"`1760217603          default: organization1760417605      - `Workspace object`1760617607        Scope selecting one workspace of a Claude Console organization.1760817609        - `type: "workspace"`1761017611          Scope type. Always `workspace` for this scope.1761217613          default: workspace1761417615        - `workspace_id: string`1761617617          Tagged ID of the workspace the spend limit applies to.1761817619    - `source: User or SeatTier or RBACGroup or 3 more`1762017621      - `User object`1762217623        Scope selecting a single member of the organization.1762417625        - `type: "user"`1762617627          Scope type. Always `user` for this scope.1762817629          default: user1763017631        - `user_id: string`1763217633          Tagged ID of the member the spend limit applies to.1763417635      - `SeatTier object`1763617637        - `type: "seat_tier"`1763817639          default: seat_tier1764017641        - `seat_tier: string`1764217643      - `RBACGroup object`1764417645        - `type: "rbac_group"`1764617647          default: rbac_group1764817649        - `rbac_group_id: string`1765017651      - `OrganizationService object`1765217653        - `type: "organization_service"`1765417655          default: organization_service1765617657        - `service: string`1765817659      - `Organization object`1766017661        - `type: "organization"`1766217663          default: organization1766417665      - `Workspace object`1766617667        Scope selecting one workspace of a Claude Console organization.1766817669        - `type: "workspace"`1767017671          Scope type. Always `workspace` for this scope.1767217673          default: workspace1767417675        - `workspace_id: string`1767617677          Tagged ID of the workspace the spend limit applies to.1767817679    - `spend_limit_id: string`1768017681  - `status: "approved" or "denied" or "pending"`1768217683    - `"approved"`1768417685    - `"denied"`1768617687    - `"pending"`1768817689- `next_page: string or null`1769017691#### Example1769217693```bash17694curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests \17695    -H 'anthropic-version: 2023-06-01' \17696    -H "X-Api-Key: $ANTHROPIC_API_KEY"17697```1769817699##### Response (200)1770017701```json17702{17703  "data": [17704    {17705      "id": "id",17706      "actor": {17707        "deleted": true,17708        "email_address": "email_address",17709        "name": "name",17710        "type": "user_actor",17711        "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"17712      },17713      "created_at": "2019-12-27T18:11:19.117Z",17714      "period": "monthly",17715      "resolved_at": "2019-12-27T18:11:19.117Z",17716      "resolved_by": {17717        "deleted": true,17718        "email_address": "email_address",17719        "name": "name",17720        "type": "user_actor",17721        "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"17722      },17723      "spend_summary": {17724        "actor": {17725          "deleted": true,17726          "email_address": "email_address",17727          "name": "name",17728          "type": "user_actor",17729          "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"17730        },17731        "amount": "50000",17732        "currency": "USD",17733        "period": "monthly",17734        "period_to_date_spend": "12050.5",17735        "scope": {17736          "type": "user",17737          "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"17738        },17739        "source": {17740          "type": "user",17741          "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"17742        },17743        "spend_limit_id": "spend_limit_id"17744      },17745      "status": "approved",17746      "type": "spend_limit_increase_request"17747    }17748  ],17749  "next_page": "next_page"17750}17751```1775217753### Get Spend Limit Increase Request1775417755**GET** `/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}`1775617757Retrieve a spend limit increase request.1775817759While `pending`, the response includes a live `spend_summary` for the17760requester at the request's period.1776117762#### Path parameters1776317764- `spend_limit_increase_request_id: string`1776517766  ID of the spend limit increase request.1776717768#### Returns1776917770- `BetaSpendLimitIncreaseRequest object`1777117772  - `type: "spend_limit_increase_request"`1777317774    default: spend_limit_increase_request1777517776  - `id: string`1777717778  - `actor: object`1777917780    A user within the organization. `name` and `email_address` are17781    null when the underlying account is unavailable or has been deleted;17782    `deleted` is true only for deleted accounts.1778317784    - `type: "user_actor"`1778517786      Actor type. Always `user_actor`.1778717788      default: user_actor1778917790    - `deleted: boolean`1779117792      True only when the underlying account has been deleted.1779317794      default: false1779517796    - `email_address: string or null`1779717798      The user's email address. Null when the account is unavailable or has been deleted.1779917800    - `name: string or null`1780117802      The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.1780317804    - `user_id: string`1780517806      Tagged ID of the user.1780717808  - `created_at: string`1780917810    format: date-time1781117812  - `period: "daily" or "monthly" or "weekly"`1781317814    - `"daily"`1781517816    - `"monthly"`1781717818    - `"weekly"`1781917820  - `resolved_at: string or null`1782117822    format: date-time1782317824  - `resolved_by: UserActor or ScopedAPIKeyActor or null`1782517826    - `UserActor object`1782717828      A user within the organization. `name` and `email_address` are17829      null when the underlying account is unavailable or has been deleted;17830      `deleted` is true only for deleted accounts.1783117832      - `type: "user_actor"`1783317834        Actor type. Always `user_actor`.1783517836        default: user_actor1783717838      - `deleted: boolean`1783917840        True only when the underlying account has been deleted.1784117842        default: false1784317844      - `email_address: string or null`1784517846        The user's email address. Null when the account is unavailable or has been deleted.1784717848      - `name: string or null`1784917850        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.1785117852      - `user_id: string`1785317854        Tagged ID of the user.1785517856    - `ScopedAPIKeyActor object`1785717858      A scoped Admin API key acting on behalf of the organization.1785917860      - `type: "scoped_api_key_actor"`1786117862        default: scoped_api_key_actor1786317864      - `scoped_api_key_id: string`1786517866  - `spend_summary: BetaSpendSummary or null`1786717868    Per-member effective-limit report row (`GET /spend_limits/effective`).1786917870    - `actor: UserActor or ScopedAPIKeyActor`1787117872      - `UserActor object`1787317874        A user within the organization. `name` and `email_address` are17875        null when the underlying account is unavailable or has been deleted;17876        `deleted` is true only for deleted accounts.1787717878        - `type: "user_actor"`1787917880          Actor type. Always `user_actor`.1788117882          default: user_actor1788317884        - `deleted: boolean`1788517886          True only when the underlying account has been deleted.1788717888          default: false1788917890        - `email_address: string or null`1789117892          The user's email address. Null when the account is unavailable or has been deleted.1789317894        - `name: string or null`1789517896          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.1789717898        - `user_id: string`1789917900          Tagged ID of the user.1790117902      - `ScopedAPIKeyActor object`1790317904        A scoped Admin API key acting on behalf of the organization.1790517906        - `type: "scoped_api_key_actor"`1790717908          default: scoped_api_key_actor1790917910        - `scoped_api_key_id: string`1791117912    - `amount: string or null`1791317914      Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.1791517916    - `currency: string`1791717918      ISO 4217 code of the organization's billing currency; the unit for `amount` and `period_to_date_spend`.1791917920    - `period: "daily" or "monthly" or "weekly"`1792117922      Period this row's effective limit and spend are reported for.1792317924      - `"daily"`1792517926      - `"monthly"`1792717928      - `"weekly"`1792917930    - `period_to_date_spend: string`1793117932      The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.1793317934    - `scope: User or SeatTier or RBACGroup or 3 more`1793517936      - `User object`1793717938        Scope selecting a single member of the organization.1793917940        - `type: "user"`1794117942          Scope type. Always `user` for this scope.1794317944          default: user1794517946        - `user_id: string`1794717948          Tagged ID of the member the spend limit applies to.1794917950      - `SeatTier object`1795117952        - `type: "seat_tier"`1795317954          default: seat_tier1795517956        - `seat_tier: string`1795717958      - `RBACGroup object`1795917960        - `type: "rbac_group"`1796117962          default: rbac_group1796317964        - `rbac_group_id: string`1796517966      - `OrganizationService object`1796717968        - `type: "organization_service"`1796917970          default: organization_service1797117972        - `service: string`1797317974      - `Organization object`1797517976        - `type: "organization"`1797717978          default: organization1797917980      - `Workspace object`1798117982        Scope selecting one workspace of a Claude Console organization.1798317984        - `type: "workspace"`1798517986          Scope type. Always `workspace` for this scope.1798717988          default: workspace1798917990        - `workspace_id: string`1799117992          Tagged ID of the workspace the spend limit applies to.1799317994    - `source: User or SeatTier or RBACGroup or 3 more`1799517996      - `User object`1799717998        Scope selecting a single member of the organization.1799918000        - `type: "user"`1800118002          Scope type. Always `user` for this scope.1800318004          default: user1800518006        - `user_id: string`1800718008          Tagged ID of the member the spend limit applies to.1800918010      - `SeatTier object`1801118012        - `type: "seat_tier"`1801318014          default: seat_tier1801518016        - `seat_tier: string`1801718018      - `RBACGroup object`1801918020        - `type: "rbac_group"`1802118022          default: rbac_group1802318024        - `rbac_group_id: string`1802518026      - `OrganizationService object`1802718028        - `type: "organization_service"`1802918030          default: organization_service1803118032        - `service: string`1803318034      - `Organization object`1803518036        - `type: "organization"`1803718038          default: organization1803918040      - `Workspace object`1804118042        Scope selecting one workspace of a Claude Console organization.1804318044        - `type: "workspace"`1804518046          Scope type. Always `workspace` for this scope.1804718048          default: workspace1804918050        - `workspace_id: string`1805118052          Tagged ID of the workspace the spend limit applies to.1805318054    - `spend_limit_id: string`1805518056  - `status: "approved" or "denied" or "pending"`1805718058    - `"approved"`1805918060    - `"denied"`1806118062    - `"pending"`1806318064#### Example1806518066```bash18067curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$SPEND_LIMIT_INCREASE_REQUEST_ID \18068    -H 'anthropic-version: 2023-06-01' \18069    -H "X-Api-Key: $ANTHROPIC_API_KEY"18070```1807118072##### Response (200)1807318074```json18075{18076  "id": "id",18077  "actor": {18078    "deleted": true,18079    "email_address": "email_address",18080    "name": "name",18081    "type": "user_actor",18082    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18083  },18084  "created_at": "2019-12-27T18:11:19.117Z",18085  "period": "monthly",18086  "resolved_at": "2019-12-27T18:11:19.117Z",18087  "resolved_by": {18088    "deleted": true,18089    "email_address": "email_address",18090    "name": "name",18091    "type": "user_actor",18092    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18093  },18094  "spend_summary": {18095    "actor": {18096      "deleted": true,18097      "email_address": "email_address",18098      "name": "name",18099      "type": "user_actor",18100      "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18101    },18102    "amount": "50000",18103    "currency": "USD",18104    "period": "monthly",18105    "period_to_date_spend": "12050.5",18106    "scope": {18107      "type": "user",18108      "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18109    },18110    "source": {18111      "type": "user",18112      "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18113    },18114    "spend_limit_id": "spend_limit_id"18115  },18116  "status": "approved",18117  "type": "spend_limit_increase_request"18118}18119```1812018121### Approve Spend Limit Increase Request1812218123**POST** `/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}/approve`1812418125Approve a pending spend limit increase request.1812618127Writes a per-user spend limit at `amount` for the requester and18128transitions the request to `approved`. `period` defaults to the period18129the member was blocked on. Anthropic emails the requester unless18130`suppress_notification` is set.1813118132#### Path parameters1813318134- `spend_limit_increase_request_id: string`1813518136  ID of the spend limit increase request.1813718138#### Body parameters1813918140- `amount: string`1814118142  New per-user spend limit as a non-negative integer decimal string (minor units).1814318144- `period: optional "daily" or "monthly" or "weekly" or null`1814518146  - `"daily"`1814718148  - `"monthly"`1814918150  - `"weekly"`1815118152- `suppress_notification: optional boolean`1815318154#### Returns1815518156- `type: "spend_limit_increase_request"`1815718158  default: spend_limit_increase_request1815918160- `id: string`1816118162- `actor: object`1816318164  A user within the organization. `name` and `email_address` are18165  null when the underlying account is unavailable or has been deleted;18166  `deleted` is true only for deleted accounts.1816718168  - `type: "user_actor"`1816918170    Actor type. Always `user_actor`.1817118172    default: user_actor1817318174  - `deleted: boolean`1817518176    True only when the underlying account has been deleted.1817718178    default: false1817918180  - `email_address: string or null`1818118182    The user's email address. Null when the account is unavailable or has been deleted.1818318184  - `name: string or null`1818518186    The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.1818718188  - `user_id: string`1818918190    Tagged ID of the user.1819118192- `created_at: string`1819318194  format: date-time1819518196- `period: "daily" or "monthly" or "weekly"`1819718198  - `"daily"`1819918200  - `"monthly"`1820118202  - `"weekly"`1820318204- `resolved_at: string or null`1820518206  format: date-time1820718208- `resolved_by: UserActor or ScopedAPIKeyActor or null`1820918210  - `UserActor object`1821118212    A user within the organization. `name` and `email_address` are18213    null when the underlying account is unavailable or has been deleted;18214    `deleted` is true only for deleted accounts.1821518216    - `type: "user_actor"`1821718218      Actor type. Always `user_actor`.1821918220      default: user_actor1822118222    - `deleted: boolean`1822318224      True only when the underlying account has been deleted.1822518226      default: false1822718228    - `email_address: string or null`1822918230      The user's email address. Null when the account is unavailable or has been deleted.1823118232    - `name: string or null`1823318234      The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.1823518236    - `user_id: string`1823718238      Tagged ID of the user.1823918240  - `ScopedAPIKeyActor object`1824118242    A scoped Admin API key acting on behalf of the organization.1824318244    - `type: "scoped_api_key_actor"`1824518246      default: scoped_api_key_actor1824718248    - `scoped_api_key_id: string`1824918250- `spend_limit: BetaSpendLimit`1825118252  A configured spend limit: a cap on metered spend for one scope and period.1825318254  - `type: "spend_limit"`1825518256    Object type. Always `spend_limit`.1825718258    default: spend_limit1825918260  - `id: string`1826118262    Unique tagged ID of the spend limit (`spl_...`).1826318264  - `amount: string or null`1826518266    Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies.1826718268  - `created_at: string`1826918270    RFC 3339 datetime at which the spend limit was created.1827118272    format: date-time1827318274  - `currency: string`1827518276    ISO 4217 code of the organization's billing currency; the unit for `amount`.1827718278  - `period: "daily" or "monthly" or "weekly"`1827918280    Length of the window the limit resets over. `amount` caps spend within each period.1828118282    - `"daily"`1828318284    - `"monthly"`1828518286    - `"weekly"`1828718288  - `scope: User or SeatTier or RBACGroup or 3 more`1828918290    What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope.1829118292    - `User object`1829318294      Scope selecting a single member of the organization.1829518296      - `type: "user"`1829718298        Scope type. Always `user` for this scope.1829918300        default: user1830118302      - `user_id: string`1830318304        Tagged ID of the member the spend limit applies to.1830518306    - `SeatTier object`1830718308      - `type: "seat_tier"`1830918310        default: seat_tier1831118312      - `seat_tier: string`1831318314    - `RBACGroup object`1831518316      - `type: "rbac_group"`1831718318        default: rbac_group1831918320      - `rbac_group_id: string`1832118322    - `OrganizationService object`1832318324      - `type: "organization_service"`1832518326        default: organization_service1832718328      - `service: string`1832918330    - `Organization object`1833118332      - `type: "organization"`1833318334        default: organization1833518336    - `Workspace object`1833718338      Scope selecting one workspace of a Claude Console organization.1833918340      - `type: "workspace"`1834118342        Scope type. Always `workspace` for this scope.1834318344        default: workspace1834518346      - `workspace_id: string`1834718348        Tagged ID of the workspace the spend limit applies to.1834918350  - `updated_at: string`1835118352    RFC 3339 datetime at which the spend limit was last modified.1835318354    format: date-time1835518356- `spend_summary: BetaSpendSummary or null`1835718358  Per-member effective-limit report row (`GET /spend_limits/effective`).1835918360  - `actor: UserActor or ScopedAPIKeyActor`1836118362    - `UserActor object`1836318364      A user within the organization. `name` and `email_address` are18365      null when the underlying account is unavailable or has been deleted;18366      `deleted` is true only for deleted accounts.1836718368      - `type: "user_actor"`1836918370        Actor type. Always `user_actor`.1837118372        default: user_actor1837318374      - `deleted: boolean`1837518376        True only when the underlying account has been deleted.1837718378        default: false1837918380      - `email_address: string or null`1838118382        The user's email address. Null when the account is unavailable or has been deleted.1838318384      - `name: string or null`1838518386        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.1838718388      - `user_id: string`1838918390        Tagged ID of the user.1839118392    - `ScopedAPIKeyActor object`1839318394      A scoped Admin API key acting on behalf of the organization.1839518396      - `type: "scoped_api_key_actor"`1839718398        default: scoped_api_key_actor1839918400      - `scoped_api_key_id: string`1840118402  - `amount: string or null`1840318404    Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.1840518406  - `currency: string`1840718408    ISO 4217 code of the organization's billing currency; the unit for `amount` and `period_to_date_spend`.1840918410  - `period: "daily" or "monthly" or "weekly"`1841118412    Period this row's effective limit and spend are reported for.1841318414    - `"daily"`1841518416    - `"monthly"`1841718418    - `"weekly"`1841918420  - `period_to_date_spend: string`1842118422    The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.1842318424  - `scope: User or SeatTier or RBACGroup or 3 more`1842518426    - `User object`1842718428      Scope selecting a single member of the organization.1842918430      - `type: "user"`1843118432        Scope type. Always `user` for this scope.1843318434        default: user1843518436      - `user_id: string`1843718438        Tagged ID of the member the spend limit applies to.1843918440    - `SeatTier object`1844118442      - `type: "seat_tier"`1844318444        default: seat_tier1844518446      - `seat_tier: string`1844718448    - `RBACGroup object`1844918450      - `type: "rbac_group"`1845118452        default: rbac_group1845318454      - `rbac_group_id: string`1845518456    - `OrganizationService object`1845718458      - `type: "organization_service"`1845918460        default: organization_service1846118462      - `service: string`1846318464    - `Organization object`1846518466      - `type: "organization"`1846718468        default: organization1846918470    - `Workspace object`1847118472      Scope selecting one workspace of a Claude Console organization.1847318474      - `type: "workspace"`1847518476        Scope type. Always `workspace` for this scope.1847718478        default: workspace1847918480      - `workspace_id: string`1848118482        Tagged ID of the workspace the spend limit applies to.1848318484  - `source: User or SeatTier or RBACGroup or 3 more`1848518486    - `User object`1848718488      Scope selecting a single member of the organization.1848918490      - `type: "user"`1849118492        Scope type. Always `user` for this scope.1849318494        default: user1849518496      - `user_id: string`1849718498        Tagged ID of the member the spend limit applies to.1849918500    - `SeatTier object`1850118502      - `type: "seat_tier"`1850318504        default: seat_tier1850518506      - `seat_tier: string`1850718508    - `RBACGroup object`1850918510      - `type: "rbac_group"`1851118512        default: rbac_group1851318514      - `rbac_group_id: string`1851518516    - `OrganizationService object`1851718518      - `type: "organization_service"`1851918520        default: organization_service1852118522      - `service: string`1852318524    - `Organization object`1852518526      - `type: "organization"`1852718528        default: organization1852918530    - `Workspace object`1853118532      Scope selecting one workspace of a Claude Console organization.1853318534      - `type: "workspace"`1853518536        Scope type. Always `workspace` for this scope.1853718538        default: workspace1853918540      - `workspace_id: string`1854118542        Tagged ID of the workspace the spend limit applies to.1854318544  - `spend_limit_id: string`1854518546- `status: "approved" or "denied" or "pending"`1854718548  - `"approved"`1854918550  - `"denied"`1855118552  - `"pending"`1855318554#### Example1855518556```bash18557curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$SPEND_LIMIT_INCREASE_REQUEST_ID/approve \18558    -H 'Content-Type: application/json' \18559    -H 'anthropic-version: 2023-06-01' \18560    -H "X-Api-Key: $ANTHROPIC_API_KEY" \18561    -d '{18562          "amount": "50000",18563          "period": "monthly"18564        }'18565```1856618567##### Response (200)1856818569```json18570{18571  "id": "id",18572  "actor": {18573    "deleted": true,18574    "email_address": "email_address",18575    "name": "name",18576    "type": "user_actor",18577    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18578  },18579  "created_at": "2019-12-27T18:11:19.117Z",18580  "period": "monthly",18581  "resolved_at": "2019-12-27T18:11:19.117Z",18582  "resolved_by": {18583    "deleted": true,18584    "email_address": "email_address",18585    "name": "name",18586    "type": "user_actor",18587    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18588  },18589  "spend_limit": {18590    "id": "id",18591    "amount": "50000",18592    "created_at": "2019-12-27T18:11:19.117Z",18593    "currency": "USD",18594    "period": "monthly",18595    "scope": {18596      "type": "user",18597      "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18598    },18599    "type": "spend_limit",18600    "updated_at": "2019-12-27T18:11:19.117Z"18601  },18602  "spend_summary": {18603    "actor": {18604      "deleted": true,18605      "email_address": "email_address",18606      "name": "name",18607      "type": "user_actor",18608      "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18609    },18610    "amount": "50000",18611    "currency": "USD",18612    "period": "monthly",18613    "period_to_date_spend": "12050.5",18614    "scope": {18615      "type": "user",18616      "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18617    },18618    "source": {18619      "type": "user",18620      "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18621    },18622    "spend_limit_id": "spend_limit_id"18623  },18624  "status": "approved",18625  "type": "spend_limit_increase_request"18626}18627```1862818629### Deny Spend Limit Increase Request1863018631**POST** `/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}/deny`1863218633Deny a pending spend limit increase request.1863418635Idempotent on `denied`; denying an already-`approved` request returns18636400. Anthropic emails the requester unless `suppress_notification` is set.1863718638#### Path parameters1863918640- `spend_limit_increase_request_id: string`1864118642  ID of the spend limit increase request.1864318644#### Body parameters1864518646- `suppress_notification: optional boolean`1864718648#### Returns1864918650- `BetaSpendLimitIncreaseRequest object`1865118652  - `type: "spend_limit_increase_request"`1865318654    default: spend_limit_increase_request1865518656  - `id: string`1865718658  - `actor: object`1865918660    A user within the organization. `name` and `email_address` are18661    null when the underlying account is unavailable or has been deleted;18662    `deleted` is true only for deleted accounts.1866318664    - `type: "user_actor"`1866518666      Actor type. Always `user_actor`.1866718668      default: user_actor1866918670    - `deleted: boolean`1867118672      True only when the underlying account has been deleted.1867318674      default: false1867518676    - `email_address: string or null`1867718678      The user's email address. Null when the account is unavailable or has been deleted.1867918680    - `name: string or null`1868118682      The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.1868318684    - `user_id: string`1868518686      Tagged ID of the user.1868718688  - `created_at: string`1868918690    format: date-time1869118692  - `period: "daily" or "monthly" or "weekly"`1869318694    - `"daily"`1869518696    - `"monthly"`1869718698    - `"weekly"`1869918700  - `resolved_at: string or null`1870118702    format: date-time1870318704  - `resolved_by: UserActor or ScopedAPIKeyActor or null`1870518706    - `UserActor object`1870718708      A user within the organization. `name` and `email_address` are18709      null when the underlying account is unavailable or has been deleted;18710      `deleted` is true only for deleted accounts.1871118712      - `type: "user_actor"`1871318714        Actor type. Always `user_actor`.1871518716        default: user_actor1871718718      - `deleted: boolean`1871918720        True only when the underlying account has been deleted.1872118722        default: false1872318724      - `email_address: string or null`1872518726        The user's email address. Null when the account is unavailable or has been deleted.1872718728      - `name: string or null`1872918730        The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.1873118732      - `user_id: string`1873318734        Tagged ID of the user.1873518736    - `ScopedAPIKeyActor object`1873718738      A scoped Admin API key acting on behalf of the organization.1873918740      - `type: "scoped_api_key_actor"`1874118742        default: scoped_api_key_actor1874318744      - `scoped_api_key_id: string`1874518746  - `spend_summary: BetaSpendSummary or null`1874718748    Per-member effective-limit report row (`GET /spend_limits/effective`).1874918750    - `actor: UserActor or ScopedAPIKeyActor`1875118752      - `UserActor object`1875318754        A user within the organization. `name` and `email_address` are18755        null when the underlying account is unavailable or has been deleted;18756        `deleted` is true only for deleted accounts.1875718758        - `type: "user_actor"`1875918760          Actor type. Always `user_actor`.1876118762          default: user_actor1876318764        - `deleted: boolean`1876518766          True only when the underlying account has been deleted.1876718768          default: false1876918770        - `email_address: string or null`1877118772          The user's email address. Null when the account is unavailable or has been deleted.1877318774        - `name: string or null`1877518776          The user's current display name. Null when the account is unavailable, has been deleted, or has no name set.1877718778        - `user_id: string`1877918780          Tagged ID of the user.1878118782      - `ScopedAPIKeyActor object`1878318784        A scoped Admin API key acting on behalf of the organization.1878518786        - `type: "scoped_api_key_actor"`1878718788          default: scoped_api_key_actor1878918790        - `scoped_api_key_id: string`1879118792    - `amount: string or null`1879318794      Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.1879518796    - `currency: string`1879718798      ISO 4217 code of the organization's billing currency; the unit for `amount` and `period_to_date_spend`.1879918800    - `period: "daily" or "monthly" or "weekly"`1880118802      Period this row's effective limit and spend are reported for.1880318804      - `"daily"`1880518806      - `"monthly"`1880718808      - `"weekly"`1880918810    - `period_to_date_spend: string`1881118812      The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.1881318814    - `scope: User or SeatTier or RBACGroup or 3 more`1881518816      - `User object`1881718818        Scope selecting a single member of the organization.1881918820        - `type: "user"`1882118822          Scope type. Always `user` for this scope.1882318824          default: user1882518826        - `user_id: string`1882718828          Tagged ID of the member the spend limit applies to.1882918830      - `SeatTier object`1883118832        - `type: "seat_tier"`1883318834          default: seat_tier1883518836        - `seat_tier: string`1883718838      - `RBACGroup object`1883918840        - `type: "rbac_group"`1884118842          default: rbac_group1884318844        - `rbac_group_id: string`1884518846      - `OrganizationService object`1884718848        - `type: "organization_service"`1884918850          default: organization_service1885118852        - `service: string`1885318854      - `Organization object`1885518856        - `type: "organization"`1885718858          default: organization1885918860      - `Workspace object`1886118862        Scope selecting one workspace of a Claude Console organization.1886318864        - `type: "workspace"`1886518866          Scope type. Always `workspace` for this scope.1886718868          default: workspace1886918870        - `workspace_id: string`1887118872          Tagged ID of the workspace the spend limit applies to.1887318874    - `source: User or SeatTier or RBACGroup or 3 more`1887518876      - `User object`1887718878        Scope selecting a single member of the organization.1887918880        - `type: "user"`1888118882          Scope type. Always `user` for this scope.1888318884          default: user1888518886        - `user_id: string`1888718888          Tagged ID of the member the spend limit applies to.1888918890      - `SeatTier object`1889118892        - `type: "seat_tier"`1889318894          default: seat_tier1889518896        - `seat_tier: string`1889718898      - `RBACGroup object`1889918900        - `type: "rbac_group"`1890118902          default: rbac_group1890318904        - `rbac_group_id: string`1890518906      - `OrganizationService object`1890718908        - `type: "organization_service"`1890918910          default: organization_service1891118912        - `service: string`1891318914      - `Organization object`1891518916        - `type: "organization"`1891718918          default: organization1891918920      - `Workspace object`1892118922        Scope selecting one workspace of a Claude Console organization.1892318924        - `type: "workspace"`1892518926          Scope type. Always `workspace` for this scope.1892718928          default: workspace1892918930        - `workspace_id: string`1893118932          Tagged ID of the workspace the spend limit applies to.1893318934    - `spend_limit_id: string`1893518936  - `status: "approved" or "denied" or "pending"`1893718938    - `"approved"`1893918940    - `"denied"`1894118942    - `"pending"`1894318944#### Example1894518946```bash18947curl https://api.anthropic.com/v1/organizations/spend_limit_increase_requests/$SPEND_LIMIT_INCREASE_REQUEST_ID/deny \18948    -H 'Content-Type: application/json' \18949    -H 'anthropic-version: 2023-06-01' \18950    -H "X-Api-Key: $ANTHROPIC_API_KEY" \18951    -d '{}'18952```1895318954##### Response (200)1895518956```json18957{18958  "id": "id",18959  "actor": {18960    "deleted": true,18961    "email_address": "email_address",18962    "name": "name",18963    "type": "user_actor",18964    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18965  },18966  "created_at": "2019-12-27T18:11:19.117Z",18967  "period": "monthly",18968  "resolved_at": "2019-12-27T18:11:19.117Z",18969  "resolved_by": {18970    "deleted": true,18971    "email_address": "email_address",18972    "name": "name",18973    "type": "user_actor",18974    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18975  },18976  "spend_summary": {18977    "actor": {18978      "deleted": true,18979      "email_address": "email_address",18980      "name": "name",18981      "type": "user_actor",18982      "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18983    },18984    "amount": "50000",18985    "currency": "USD",18986    "period": "monthly",18987    "period_to_date_spend": "12050.5",18988    "scope": {18989      "type": "user",18990      "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18991    },18992    "source": {18993      "type": "user",18994      "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"18995    },18996    "spend_limit_id": "spend_limit_id"18997  },18998  "status": "approved",18999  "type": "spend_limit_increase_request"19000}19001```1900219003## Organization › RBAC Groups1900419005### List RBAC Groups1900619007**GET** `/v1/organizations/rbac_groups`1900819009List RBAC Groups in the Claude Enterprise tenant.1901019011The RBAC Groups API is available to Claude Enterprise organizations only.1901219013#### Query parameters1901419015- `limit: optional number`1901619017  Number of items to return per page.1901819019  Defaults to `20`. Ranges from `1` to `1000`.1902019021  default: 20, maximum: 1000, minimum: 11902219023- `page: optional string`1902419025  Optionally set to the `next_page` token from the previous response.1902619027#### Returns1902819029- `data: array of BetaRBACGroup`1903019031  - `type: "rbac_group"`1903219033    Object type.1903419035    For RBAC Groups, this is always `"rbac_group"`.1903619037    default: rbac_group1903819039  - `id: string`1904019041    ID of the RBAC Group.1904219043  - `created_at: string`1904419045    RFC 3339 timestamp of when the RBAC Group was created.1904619047    format: date-time1904819049  - `name: string`1905019051    Name of the RBAC Group. Not uniqueness-enforced.1905219053  - `roles: array of string or null`1905419055    RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.1905619057  - `source_type: "direct" or "scim"`1905819059    How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.1906019061    - `"direct"`1906219063    - `"scim"`1906419065  - `updated_at: string`1906619067    RFC 3339 timestamp of when the RBAC Group was last updated.1906819069    format: date-time1907019071- `has_more: boolean`1907219073  Indicates if there are more results in the requested page direction.1907419075- `next_page: string or null`1907619077  Token to provide in as `page` in the subsequent request to retrieve the next page of data.1907819079#### Example1908019081```bash19082curl https://api.anthropic.com/v1/organizations/rbac_groups \19083    -H 'anthropic-version: 2023-06-01' \19084    -H "X-Api-Key: $ANTHROPIC_API_KEY"19085```1908619087##### Response (200)1908819089```json19090{19091  "data": [19092    {19093      "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",19094      "created_at": "2024-10-30T23:58:27.427722Z",19095      "name": "Engineering",19096      "roles": [19097        "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"19098      ],19099      "source_type": "direct",19100      "type": "rbac_group",19101      "updated_at": "2024-10-30T23:58:27.427722Z"19102    }19103  ],19104  "has_more": false,19105  "next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9"19106}19107```1910819109### Get RBAC Group1911019111**GET** `/v1/organizations/rbac_groups/{group_id}`1911219113Retrieve an RBAC Group by ID.1911419115The RBAC Groups API is available to Claude Enterprise organizations only.1911619117#### Path parameters1911819119- `group_id: string`1912019121  ID of the RBAC Group.1912219123#### Returns1912419125- `BetaRBACGroup object`1912619127  - `type: "rbac_group"`1912819129    Object type.1913019131    For RBAC Groups, this is always `"rbac_group"`.1913219133    default: rbac_group1913419135  - `id: string`1913619137    ID of the RBAC Group.1913819139  - `created_at: string`1914019141    RFC 3339 timestamp of when the RBAC Group was created.1914219143    format: date-time1914419145  - `name: string`1914619147    Name of the RBAC Group. Not uniqueness-enforced.1914819149  - `roles: array of string or null`1915019151    RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.1915219153  - `source_type: "direct" or "scim"`1915419155    How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.1915619157    - `"direct"`1915819159    - `"scim"`1916019161  - `updated_at: string`1916219163    RFC 3339 timestamp of when the RBAC Group was last updated.1916419165    format: date-time1916619167#### Example1916819169```bash19170curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \19171    -H 'anthropic-version: 2023-06-01' \19172    -H "X-Api-Key: $ANTHROPIC_API_KEY"19173```1917419175##### Response (200)1917619177```json19178{19179  "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",19180  "created_at": "2024-10-30T23:58:27.427722Z",19181  "name": "Engineering",19182  "roles": [19183    "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"19184  ],19185  "source_type": "direct",19186  "type": "rbac_group",19187  "updated_at": "2024-10-30T23:58:27.427722Z"19188}19189```1919019191### Create RBAC Group1919219193**POST** `/v1/organizations/rbac_groups`1919419195Create an RBAC Group in the Claude Enterprise tenant. Groups created via the API have source type `"direct"`.1919619197The RBAC Groups API is available to Claude Enterprise organizations only.1919819199#### Body parameters1920019201- `name: string`1920219203  Name of the RBAC Group. Not uniqueness-enforced.1920419205  maxLength: 255, minLength: 11920619207#### Returns1920819209- `BetaRBACGroup object`1921019211  - `type: "rbac_group"`1921219213    Object type.1921419215    For RBAC Groups, this is always `"rbac_group"`.1921619217    default: rbac_group1921819219  - `id: string`1922019221    ID of the RBAC Group.1922219223  - `created_at: string`1922419225    RFC 3339 timestamp of when the RBAC Group was created.1922619227    format: date-time1922819229  - `name: string`1923019231    Name of the RBAC Group. Not uniqueness-enforced.1923219233  - `roles: array of string or null`1923419235    RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.1923619237  - `source_type: "direct" or "scim"`1923819239    How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.1924019241    - `"direct"`1924219243    - `"scim"`1924419245  - `updated_at: string`1924619247    RFC 3339 timestamp of when the RBAC Group was last updated.1924819249    format: date-time1925019251#### Example1925219253```bash19254curl https://api.anthropic.com/v1/organizations/rbac_groups \19255    -H 'Content-Type: application/json' \19256    -H 'anthropic-version: 2023-06-01' \19257    -H "X-Api-Key: $ANTHROPIC_API_KEY" \19258    -d '{19259          "name": "Engineering"19260        }'19261```1926219263##### Response (200)1926419265```json19266{19267  "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",19268  "created_at": "2024-10-30T23:58:27.427722Z",19269  "name": "Engineering",19270  "roles": [19271    "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"19272  ],19273  "source_type": "direct",19274  "type": "rbac_group",19275  "updated_at": "2024-10-30T23:58:27.427722Z"19276}19277```1927819279### Update RBAC Group1928019281**POST** `/v1/organizations/rbac_groups/{group_id}`1928219283Update an RBAC Group's name. Groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.1928419285The RBAC Groups API is available to Claude Enterprise organizations only.1928619287#### Path parameters1928819289- `group_id: string`1929019291  ID of the RBAC Group.1929219293#### Body parameters1929419295- `name: optional string or null`1929619297  Name of the RBAC Group. Not uniqueness-enforced.1929819299  maxLength: 255, minLength: 11930019301#### Returns1930219303- `BetaRBACGroup object`1930419305  - `type: "rbac_group"`1930619307    Object type.1930819309    For RBAC Groups, this is always `"rbac_group"`.1931019311    default: rbac_group1931219313  - `id: string`1931419315    ID of the RBAC Group.1931619317  - `created_at: string`1931819319    RFC 3339 timestamp of when the RBAC Group was created.1932019321    format: date-time1932219323  - `name: string`1932419325    Name of the RBAC Group. Not uniqueness-enforced.1932619327  - `roles: array of string or null`1932819329    RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.1933019331  - `source_type: "direct" or "scim"`1933219333    How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.1933419335    - `"direct"`1933619337    - `"scim"`1933819339  - `updated_at: string`1934019341    RFC 3339 timestamp of when the RBAC Group was last updated.1934219343    format: date-time1934419345#### Example1934619347```bash19348curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \19349    -H 'Content-Type: application/json' \19350    -H 'anthropic-version: 2023-06-01' \19351    -H "X-Api-Key: $ANTHROPIC_API_KEY" \19352    -d '{19353          "name": "Engineering"19354        }'19355```1935619357##### Response (200)1935819359```json19360{19361  "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",19362  "created_at": "2024-10-30T23:58:27.427722Z",19363  "name": "Engineering",19364  "roles": [19365    "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"19366  ],19367  "source_type": "direct",19368  "type": "rbac_group",19369  "updated_at": "2024-10-30T23:58:27.427722Z"19370}19371```1937219373### Delete RBAC Group1937419375**DELETE** `/v1/organizations/rbac_groups/{group_id}`1937619377Delete an RBAC Group. Groups provisioned by an identity provider (source type `"scim"`) cannot be deleted via the API while an organization in the tenant uses SCIM provisioning.1937819379The RBAC Groups API is available to Claude Enterprise organizations only.1938019381#### Path parameters1938219383- `group_id: string`1938419385  ID of the RBAC Group.1938619387#### Returns1938819389- `BetaRBACGroupDeleted object`1939019391  - `type: "rbac_group_deleted"`1939219393    Deleted object type.1939419395    For RBAC Groups, this is always `"rbac_group_deleted"`.1939619397    default: rbac_group_deleted1939819399  - `id: string`1940019401    ID of the RBAC Group.1940219403#### Example1940419405```bash19406curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID \19407    -X DELETE \19408    -H 'anthropic-version: 2023-06-01' \19409    -H "X-Api-Key: $ANTHROPIC_API_KEY"19410```1941119412##### Response (200)1941319414```json19415{19416  "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",19417  "type": "rbac_group_deleted"19418}19419```1942019421## Organization › RBAC Groups › Members1942219423### List RBAC Group Members1942419425**GET** `/v1/organizations/rbac_groups/{group_id}/members`1942619427List members of an RBAC Group.1942819429The RBAC Groups API is available to Claude Enterprise organizations only.1943019431#### Path parameters1943219433- `group_id: string`1943419435  ID of the RBAC Group.1943619437#### Query parameters1943819439- `limit: optional number`1944019441  Number of items to return per page.1944219443  Defaults to `20`. Ranges from `1` to `1000`.1944419445  default: 20, maximum: 1000, minimum: 11944619447- `page: optional string`1944819449  Optionally set to the `next_page` token from the previous response.1945019451#### Returns1945219453- `data: array of BetaRBACGroupMember`1945419455  - `type: "rbac_group_member"`1945619457    Object type.1945819459    For RBAC Group Members, this is always `"rbac_group_member"`.1946019461    default: rbac_group_member1946219463  - `created_at: string`1946419465    RFC 3339 timestamp of when the User was added to the RBAC Group.1946619467    format: date-time1946819469  - `email: string`1947019471    Email of the User.1947219473  - `group_id: string`1947419475    ID of the RBAC Group.1947619477  - `user_id: string`1947819479    ID of the User.1948019481- `has_more: boolean`1948219483  Indicates if there are more results in the requested page direction.1948419485- `next_page: string or null`1948619487  Token to provide in as `page` in the subsequent request to retrieve the next page of data.1948819489#### Example1949019491```bash19492curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \19493    -H 'anthropic-version: 2023-06-01' \19494    -H "X-Api-Key: $ANTHROPIC_API_KEY"19495```1949619497##### Response (200)1949819499```json19500{19501  "data": [19502    {19503      "created_at": "2024-10-30T23:58:27.427722Z",19504      "email": "user@emaildomain.com",19505      "group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",19506      "type": "rbac_group_member",19507      "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"19508    }19509  ],19510  "has_more": false,19511  "next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9"19512}19513```1951419515### Add RBAC Group Member1951619517**POST** `/v1/organizations/rbac_groups/{group_id}/members`1951819519Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.1952019521The RBAC Groups API is available to Claude Enterprise organizations only.1952219523#### Path parameters1952419525- `group_id: string`1952619527  ID of the RBAC Group.1952819529#### Body parameters1953019531- `user_id: string`1953219533  ID of the User.1953419535#### Returns1953619537- `BetaRBACGroupMember object`1953819539  - `type: "rbac_group_member"`1954019541    Object type.1954219543    For RBAC Group Members, this is always `"rbac_group_member"`.1954419545    default: rbac_group_member1954619547  - `created_at: string`1954819549    RFC 3339 timestamp of when the User was added to the RBAC Group.1955019551    format: date-time1955219553  - `email: string`1955419555    Email of the User.1955619557  - `group_id: string`1955819559    ID of the RBAC Group.1956019561  - `user_id: string`1956219563    ID of the User.1956419565#### Example1956619567```bash19568curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members \19569    -H 'Content-Type: application/json' \19570    -H 'anthropic-version: 2023-06-01' \19571    -H "X-Api-Key: $ANTHROPIC_API_KEY" \19572    -d '{19573          "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"19574        }'19575```1957619577##### Response (200)1957819579```json19580{19581  "created_at": "2024-10-30T23:58:27.427722Z",19582  "email": "user@emaildomain.com",19583  "group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",19584  "type": "rbac_group_member",19585  "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"19586}19587```1958819589### Remove RBAC Group Member1959019591**DELETE** `/v1/organizations/rbac_groups/{group_id}/members/{user_id}`1959219593Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.1959419595The RBAC Groups API is available to Claude Enterprise organizations only.1959619597#### Path parameters1959819599- `group_id: string`1960019601  ID of the RBAC Group.1960219603- `user_id: string`1960419605  ID of the User.1960619607#### Returns1960819609- `BetaRBACGroupMemberDeleted object`1961019611  - `type: "rbac_group_member_deleted"`1961219613    Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`.1961419615    default: rbac_group_member_deleted1961619617  - `group_id: string`1961819619    ID of the RBAC Group.1962019621  - `user_id: string`1962219623    ID of the User.1962419625#### Example1962619627```bash19628curl https://api.anthropic.com/v1/organizations/rbac_groups/$GROUP_ID/members/$USER_ID \19629    -X DELETE \19630    -H 'anthropic-version: 2023-06-01' \19631    -H "X-Api-Key: $ANTHROPIC_API_KEY"19632```1963319634##### Response (200)1963519636```json19637{19638  "group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",19639  "type": "rbac_group_member_deleted",19640  "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"19641}19642```1964319644## Organization › RBAC Roles1964519646### List RBAC Roles1964719648**GET** `/v1/organizations/rbac_roles`1964919650List RBAC Roles in the organization.1965119652The RBAC Roles API is available to Claude Enterprise organizations only.1965319654#### Query parameters1965519656- `limit: optional number`1965719658  Number of items to return per page.1965919660  Defaults to `20`. Ranges from `1` to `1000`.1966119662  default: 20, maximum: 1000, minimum: 11966319664- `page: optional string`1966519666  Optionally set to the `next_page` token from the previous response.1966719668#### Returns1966919670- `data: array of BetaRBACRole`1967119672  - `type: "rbac_role"`1967319674    Object type.1967519676    For RBAC Roles, this is always `"rbac_role"`.1967719678    default: rbac_role1967919680  - `id: string`1968119682    ID of the RBAC Role.1968319684  - `created_at: string`1968519686    RFC 3339 datetime string indicating when the RBAC Role was created.1968719688    format: date-time1968919690  - `name: string`1969119692    Name of the RBAC Role.1969319694  - `updated_at: string`1969519696    RFC 3339 datetime string indicating when the RBAC Role was last updated.1969719698    format: date-time1969919700- `has_more: boolean`1970119702  Indicates whether there are more results beyond this page.1970319704- `next_page: string or null`1970519706  Opaque cursor for the next page. Pass as the `page` parameter on the next19707  request.1970819709#### Example1971019711```bash19712curl https://api.anthropic.com/v1/organizations/rbac_roles \19713    -H 'anthropic-version: 2023-06-01' \19714    -H "X-Api-Key: $ANTHROPIC_API_KEY"19715```1971619717##### Response (200)1971819719```json19720{19721  "data": [19722    {19723      "id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s",19724      "created_at": "2024-10-30T23:58:27.427722Z",19725      "name": "Project Editor",19726      "type": "rbac_role",19727      "updated_at": "2024-10-30T23:58:27.427722Z"19728    }19729  ],19730  "has_more": true,19731  "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"19732}19733```1973419735### Get RBAC Role1973619737**GET** `/v1/organizations/rbac_roles/{role_id}`1973819739Retrieve an RBAC Role by ID.1974019741The RBAC Roles API is available to Claude Enterprise organizations only.1974219743#### Path parameters1974419745- `role_id: string`1974619747  ID of the RBAC Role.1974819749#### Returns1975019751- `BetaRBACRole object`1975219753  - `type: "rbac_role"`1975419755    Object type.1975619757    For RBAC Roles, this is always `"rbac_role"`.1975819759    default: rbac_role1976019761  - `id: string`1976219763    ID of the RBAC Role.1976419765  - `created_at: string`1976619767    RFC 3339 datetime string indicating when the RBAC Role was created.1976819769    format: date-time1977019771  - `name: string`1977219773    Name of the RBAC Role.1977419775  - `updated_at: string`1977619777    RFC 3339 datetime string indicating when the RBAC Role was last updated.1977819779    format: date-time1978019781#### Example1978219783```bash19784curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID \19785    -H 'anthropic-version: 2023-06-01' \19786    -H "X-Api-Key: $ANTHROPIC_API_KEY"19787```1978819789##### Response (200)1979019791```json19792{19793  "id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s",19794  "created_at": "2024-10-30T23:58:27.427722Z",19795  "name": "Project Editor",19796  "type": "rbac_role",19797  "updated_at": "2024-10-30T23:58:27.427722Z"19798}19799```1980019801## Organization › RBAC Roles › Permissions1980219803### List RBAC Role Permissions1980419805**GET** `/v1/organizations/rbac_roles/{role_id}/permissions`1980619807List the permissions an RBAC Role grants.1980819809The RBAC Roles API is available to Claude Enterprise organizations only.1981019811#### Path parameters1981219813- `role_id: string`1981419815  ID of the RBAC Role.1981619817#### Query parameters1981819819- `limit: optional number`1982019821  Number of items to return per page.1982219823  Defaults to `20`. Ranges from `1` to `1000`.1982419825  default: 20, maximum: 1000, minimum: 11982619827- `page: optional string`1982819829  Optionally set to the `next_page` token from the previous response.1983019831#### Returns1983219833- `data: array of BetaRBACRolePermission`1983419835  - `type: "rbac_role_permission"`1983619837    Object type.1983819839    For RBAC Role Permissions, this is always `"rbac_role_permission"`.1984019841    default: rbac_role_permission1984219843  - `action: string`1984419845    Action the permission grants on the resource.1984619847    The vocabulary follows the resource: an `organization` grant carries a19848    product-feature entitlement (for example `chat`), an admin-panel19849    permission entitlement (`permission_*`), or a blanket capability-access19850    mode — `capability_access_all` grants every product-feature entitlement,19851    and `capability_access_all_ga` grants the generally-available subset as19852    it stands at permission-check time; neither mode grants model-access19853    entitlements. A consumer enumerating a role's per-feature grants should19854    treat a blanket row as granting every product-feature entitlement it19855    covers, or it will under-report the role's effective access. A `connector_tool` grant carries19856    a tool-access action (`use` or `always_allow`); a `connector_scope` grant19857    carries the scope action `grant` (the role may receive the named OAuth19858    scope when tokens are minted for the connector); `connector` and19859    `all_connectors` grants carry a tool-access action, the scope action, or19860    an authentication-method action (`interactive` or `managed`).1986119862  - `resource: Organization or ConnectorTool or ConnectorScope or 2 more`1986319864    What the permission applies to.1986519866    A tagged union: `type` names the kind of resource and determines which19867    identifier fields are present.1986819869    - `Organization object`1987019871      - `type: "organization"`1987219873        Kind of resource the permission applies to.1987419875        default: organization1987619877      - `organization_id: string`1987819879        UUID of the organization the permission applies to.1988019881    - `ConnectorTool object`1988219883      - `type: "connector_tool"`1988419885        Kind of resource the permission applies to.1988619887        default: connector_tool1988819889      - `connector_id: string`1989019891        ID of the connector the permission applies to.1989219893      - `tool_name: string`1989419895        Published name of the connector tool the permission applies to.1989619897        When the published name contains characters outside `[a-zA-Z0-9_-]` (or19898        collides with a reserved form), it is server-encoded into a stable19899        `{prefix}_{32-hex}` form — a shortened readable prefix of the name plus19900        a hash — from which the published name is not recoverable.1990119902    - `ConnectorScope object`1990319904      - `type: "connector_scope"`1990519906        Kind of resource the permission applies to.1990719908        default: connector_scope1990919910      - `connector_id: string`1991119912        ID of the connector the permission applies to.1991319914      - `scope: string`1991519916        OAuth scope the permission names — the role may receive this scope when19917        tokens are minted for the connector.1991819919        Subject to the same encoding rule as `tool_name`: a scope containing19920        characters outside `[a-zA-Z0-9_-]` (or colliding with a reserved form)19921        appears server-encoded in a stable `{prefix}_{32-hex}` form. OAuth19922        scopes routinely contain `:` and `/`, so most appear encoded.1992319924    - `Connector object`1992519926      - `type: "connector"`1992719928        Kind of resource the permission applies to.1992919930        default: connector1993119932      - `connector_id: string`1993319934        ID of the connector the permission applies to.1993519936    - `AllConnectors object`1993719938      - `type: "all_connectors"`1993919940        Kind of resource the permission applies to.1994119942        default: all_connectors1994319944- `has_more: boolean`1994519946  Indicates whether there are more results beyond this page.1994719948- `next_page: string or null`1994919950  Opaque cursor for the next page. Pass as the `page` parameter on the next19951  request.1995219953#### Example1995419955```bash19956curl https://api.anthropic.com/v1/organizations/rbac_roles/$ROLE_ID/permissions \19957    -H 'anthropic-version: 2023-06-01' \19958    -H "X-Api-Key: $ANTHROPIC_API_KEY"19959```1996019961##### Response (200)1996219963```json19964{19965  "data": [19966    {19967      "action": "use",19968      "resource": {19969        "organization_id": "3c4f5e6d-7a8b-49c0-9d1e-2f3a4b5c6d7e",19970        "type": "organization"19971      },19972      "type": "rbac_role_permission"19973    }19974  ],19975  "has_more": true,19976  "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"19977}19978```19979