Repository Public
1---2title: Federation3url: https://platform.claude.com/docs/en/api/beta/organization/federation4---56# Federation78## Federation › Issuers910### Create Federation Issuer1112**POST** `/v1/organizations/federation_issuers`1314**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).1516Register an OIDC issuer that Anthropic will trust for workload identity17federation in your organization.1819The `jwks` field controls how the issuer's signing keys are obtained and20takes one of three shapes selected by `type`: `discovery` (resolve keys21through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS22URL), or `inline` (provide a static key set). When `jwks.type` is23`discovery` and no `discovery_base` is set, the issuer URL must be24publicly reachable over HTTPS so Anthropic can fetch the discovery25document; for `explicit_url` and `inline` modes the issuer URL is only26matched as the JWT's `iss` claim and is not fetched.2728#### Headers2930- `"anthropic-beta": optional array of AnthropicBeta`3132 Optional header to specify the beta version(s) you want to use.3334 - `string`3536 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`3738 - `"message-batches-2024-09-24"`3940 - `"prompt-caching-2024-07-31"`4142 - `"computer-use-2024-10-22"`4344 - `"computer-use-2025-01-24"`4546 - `"pdfs-2024-09-25"`4748 - `"token-counting-2024-11-01"`4950 - `"token-efficient-tools-2025-02-19"`5152 - `"output-128k-2025-02-19"`5354 - `"files-api-2025-04-14"`5556 - `"mcp-client-2025-04-04"`5758 - `"mcp-client-2025-11-20"`5960 - `"dev-full-thinking-2025-05-14"`6162 - `"interleaved-thinking-2025-05-14"`6364 - `"code-execution-2025-05-22"`6566 - `"extended-cache-ttl-2025-04-11"`6768 - `"context-1m-2025-08-07"`6970 - `"context-management-2025-06-27"`7172 - `"model-context-window-exceeded-2025-08-26"`7374 - `"skills-2025-10-02"`7576 - `"fast-mode-2026-02-01"`7778 - `"output-300k-2026-03-24"`7980 - `"user-profiles-2026-03-24"`8182 - `"user-profiles-2026-08-18"`8384 - `"user-profiles-2026-09-04"`8586 - `"advisor-tool-2026-03-01"`8788 - `"managed-agents-2026-04-01"`8990 - `"cache-diagnosis-2026-04-07"`9192 - `"dreaming-2026-04-21"`9394 - `"thinking-token-count-2026-05-13"`9596 - `"server-side-fallback-2026-06-01"`9798 - `"server-side-fallback-2026-07-01"`99100 - `"fallback-credit-2026-06-01"`101102 - `"fallback-credit-2026-07-01"`103104 - `"agent-memory-2026-07-22"`105106 - `"mid-conversation-tool-changes-2026-07-01"`107108 - `"compact-2026-01-12"`109110 - `"computer-use-2025-11-24"`111112 - `"mcp-tunnels-2026-06-22"`113114 - `"structured-outputs-2025-11-13"`115116 - `"task-budgets-2026-03-13"`117118 - `"thinking-display-updates-2026-08-18"`119120 - `"ce-user-management-2026-07-13"`121122 - `"mid-conversation-output-config-2026-07-01"`123124 - `"thinking-binding-controls-2026-08-01"`125126 - `"mid-conversation-system-clear-at-2026-08-21"`127128 - `"compact-2026-09-04"`129130#### Body parameters131132- `issuer_url: string`133134 The `iss` claim value to match against.135136 minLength: 1137138- `name: string`139140 Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.141142 maxLength: 255, minLength: 1143144- `check_jti: optional boolean or null`145146 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.147148- `jwks: optional BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`149150 How signing keys are obtained. Defaults to OIDC discovery.151152 - `BetaJWKSDiscovery object`153154 JWKS via the issuer's OIDC discovery document.155156 - `type: "discovery"`157158 - `ca_cert_pem: optional string or null`159160 Optional custom CA (PEM) for TLS verification of the JWKS fetch.161162 maxLength: 8192163164 - `discovery_base: optional string or null`165166 Set when the discovery URL differs from `issuer_url`.167168 - `BetaJWKSExplicitURL object`169170 JWKS fetched from a fixed endpoint.171172 - `type: "explicit_url"`173174 - `url: string`175176 JWKS endpoint.177178 minLength: 1179180 - `ca_cert_pem: optional string or null`181182 Optional custom CA (PEM) for TLS verification of the JWKS fetch.183184 maxLength: 8192185186 - `BetaJWKSInline object`187188 JWKS supplied directly; no network fetch.189190 - `type: "inline"`191192 - `keys: array of map[unknown]`193194 Inline JWK objects.195196 minItems: 1197198- `max_jwt_lifetime_seconds: optional number or null`199200 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.201202 maximum: 176400, exclusiveMinimum: 0203204#### Returns205206- `BetaFederationIssuer object`207208 Registered external OIDC identity provider.209210 Records an external IdP the organization trusts for the RFC 7523211 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.212213 - `type: "federation_issuer"`214215 default: federation_issuer216217 - `id: string`218219 Tagged ID of the federation issuer.220221 - `archived_at: string or null`222223 If set, all rules referencing this issuer reject token exchange.224225 format: date-time226227 - `archived_by_actor_id: string or null`228229 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.230231 - `check_jti: boolean`232233 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.234235 - `created_at: string`236237 When this issuer was created.238239 format: date-time240241 - `created_by_actor_id: string or null`242243 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.244245 - `issuer_url: string`246247 The `iss` claim value. Incoming JWTs must match exactly.248249 - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`250251 How signing keys are obtained for signature verification.252253 - `BetaJWKSDiscovery object`254255 JWKS via the issuer's OIDC discovery document.256257 - `type: "discovery"`258259 - `ca_cert_pem: optional string or null`260261 Optional custom CA (PEM) for TLS verification of the JWKS fetch.262263 maxLength: 8192264265 - `discovery_base: optional string or null`266267 Set when the discovery URL differs from `issuer_url`.268269 - `BetaJWKSExplicitURL object`270271 JWKS fetched from a fixed endpoint.272273 - `type: "explicit_url"`274275 - `url: string`276277 JWKS endpoint.278279 minLength: 1280281 - `ca_cert_pem: optional string or null`282283 Optional custom CA (PEM) for TLS verification of the JWKS fetch.284285 maxLength: 8192286287 - `BetaJWKSInline object`288289 JWKS supplied directly; no network fetch.290291 - `type: "inline"`292293 - `keys: array of map[unknown]`294295 Inline JWK objects.296297 minItems: 1298299 - `jwks_polling_disabled_at: string or null`300301 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.302303 format: date-time304305 - `max_jwt_lifetime_seconds: number`306307 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.308309 - `name: string`310311 Admin-chosen slug identifier.312313 - `poll_status: BetaFederationIssuerPollStatus or null`314315 Status of automatic JWKS polling for a federation issuer.316317 Anthropic periodically fetches the issuer's signing keys in the318 background. These fields summarize the most recent fetches so the319 health of the JWKS endpoint can be monitored.320321 - `consecutive_failures: number`322323 Consecutive fetch failures since the last success.324325 - `last_fetched_at: string or null`326327 When the last successful fetch completed.328329 format: date-time330331 - `next_poll_at: string or null`332333 When the next fetch is scheduled. Null if paused.334335 format: date-time336337 - `updated_at: string`338339 When this issuer was last updated.340341 format: date-time342343 - `updated_by_actor_id: string or null`344345 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.346347#### Example348349```bash350curl https://api.anthropic.com/v1/organizations/federation_issuers \351 -H 'Content-Type: application/json' \352 -H 'anthropic-version: 2023-06-01' \353 -H "X-Api-Key: $ANTHROPIC_API_KEY" \354 -d '{355 "issuer_url": "x",356 "name": "x"357 }'358```359360##### Response (200)361362```json363{364 "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",365 "archived_at": "2019-12-27T18:11:19.117Z",366 "archived_by_actor_id": "archived_by_actor_id",367 "check_jti": true,368 "created_at": "2024-10-30T23:58:27.427722Z",369 "created_by_actor_id": "created_by_actor_id",370 "issuer_url": "https://token.actions.githubusercontent.com",371 "jwks": {372 "type": "discovery",373 "ca_cert_pem": "ca_cert_pem",374 "discovery_base": "discovery_base"375 },376 "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",377 "max_jwt_lifetime_seconds": 0,378 "name": "github-actions",379 "poll_status": {380 "consecutive_failures": 0,381 "last_fetched_at": "2019-12-27T18:11:19.117Z",382 "next_poll_at": "2019-12-27T18:11:19.117Z"383 },384 "type": "federation_issuer",385 "updated_at": "2024-10-30T23:58:27.427722Z",386 "updated_by_actor_id": "updated_by_actor_id"387}388```389390### List Federation Issuers391392**GET** `/v1/organizations/federation_issuers`393394**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).395396List federation issuers in your organization.397398Archived issuers are excluded unless `include_archived=true`.399400#### Query parameters401402- `include_archived: optional boolean`403404 Include archived resources. Defaults to false.405406 default: false407408- `limit: optional number`409410 Number of results per page.411412 default: 20, maximum: 100, minimum: 1413414- `page: optional string`415416 Opaque cursor from a previous response's `next_page`.417418#### Headers419420- `"anthropic-beta": optional array of AnthropicBeta`421422 Optional header to specify the beta version(s) you want to use.423424 - `string`425426 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`427428 - `"message-batches-2024-09-24"`429430 - `"prompt-caching-2024-07-31"`431432 - `"computer-use-2024-10-22"`433434 - `"computer-use-2025-01-24"`435436 - `"pdfs-2024-09-25"`437438 - `"token-counting-2024-11-01"`439440 - `"token-efficient-tools-2025-02-19"`441442 - `"output-128k-2025-02-19"`443444 - `"files-api-2025-04-14"`445446 - `"mcp-client-2025-04-04"`447448 - `"mcp-client-2025-11-20"`449450 - `"dev-full-thinking-2025-05-14"`451452 - `"interleaved-thinking-2025-05-14"`453454 - `"code-execution-2025-05-22"`455456 - `"extended-cache-ttl-2025-04-11"`457458 - `"context-1m-2025-08-07"`459460 - `"context-management-2025-06-27"`461462 - `"model-context-window-exceeded-2025-08-26"`463464 - `"skills-2025-10-02"`465466 - `"fast-mode-2026-02-01"`467468 - `"output-300k-2026-03-24"`469470 - `"user-profiles-2026-03-24"`471472 - `"user-profiles-2026-08-18"`473474 - `"user-profiles-2026-09-04"`475476 - `"advisor-tool-2026-03-01"`477478 - `"managed-agents-2026-04-01"`479480 - `"cache-diagnosis-2026-04-07"`481482 - `"dreaming-2026-04-21"`483484 - `"thinking-token-count-2026-05-13"`485486 - `"server-side-fallback-2026-06-01"`487488 - `"server-side-fallback-2026-07-01"`489490 - `"fallback-credit-2026-06-01"`491492 - `"fallback-credit-2026-07-01"`493494 - `"agent-memory-2026-07-22"`495496 - `"mid-conversation-tool-changes-2026-07-01"`497498 - `"compact-2026-01-12"`499500 - `"computer-use-2025-11-24"`501502 - `"mcp-tunnels-2026-06-22"`503504 - `"structured-outputs-2025-11-13"`505506 - `"task-budgets-2026-03-13"`507508 - `"thinking-display-updates-2026-08-18"`509510 - `"ce-user-management-2026-07-13"`511512 - `"mid-conversation-output-config-2026-07-01"`513514 - `"thinking-binding-controls-2026-08-01"`515516 - `"mid-conversation-system-clear-at-2026-08-21"`517518 - `"compact-2026-09-04"`519520#### Returns521522- `data: array of BetaFederationIssuer`523524 - `type: "federation_issuer"`525526 default: federation_issuer527528 - `id: string`529530 Tagged ID of the federation issuer.531532 - `archived_at: string or null`533534 If set, all rules referencing this issuer reject token exchange.535536 format: date-time537538 - `archived_by_actor_id: string or null`539540 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.541542 - `check_jti: boolean`543544 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.545546 - `created_at: string`547548 When this issuer was created.549550 format: date-time551552 - `created_by_actor_id: string or null`553554 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.555556 - `issuer_url: string`557558 The `iss` claim value. Incoming JWTs must match exactly.559560 - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`561562 How signing keys are obtained for signature verification.563564 - `BetaJWKSDiscovery object`565566 JWKS via the issuer's OIDC discovery document.567568 - `type: "discovery"`569570 - `ca_cert_pem: optional string or null`571572 Optional custom CA (PEM) for TLS verification of the JWKS fetch.573574 maxLength: 8192575576 - `discovery_base: optional string or null`577578 Set when the discovery URL differs from `issuer_url`.579580 - `BetaJWKSExplicitURL object`581582 JWKS fetched from a fixed endpoint.583584 - `type: "explicit_url"`585586 - `url: string`587588 JWKS endpoint.589590 minLength: 1591592 - `ca_cert_pem: optional string or null`593594 Optional custom CA (PEM) for TLS verification of the JWKS fetch.595596 maxLength: 8192597598 - `BetaJWKSInline object`599600 JWKS supplied directly; no network fetch.601602 - `type: "inline"`603604 - `keys: array of map[unknown]`605606 Inline JWK objects.607608 minItems: 1609610 - `jwks_polling_disabled_at: string or null`611612 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.613614 format: date-time615616 - `max_jwt_lifetime_seconds: number`617618 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.619620 - `name: string`621622 Admin-chosen slug identifier.623624 - `poll_status: BetaFederationIssuerPollStatus or null`625626 Status of automatic JWKS polling for a federation issuer.627628 Anthropic periodically fetches the issuer's signing keys in the629 background. These fields summarize the most recent fetches so the630 health of the JWKS endpoint can be monitored.631632 - `consecutive_failures: number`633634 Consecutive fetch failures since the last success.635636 - `last_fetched_at: string or null`637638 When the last successful fetch completed.639640 format: date-time641642 - `next_poll_at: string or null`643644 When the next fetch is scheduled. Null if paused.645646 format: date-time647648 - `updated_at: string`649650 When this issuer was last updated.651652 format: date-time653654 - `updated_by_actor_id: string or null`655656 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.657658- `next_page: string or null`659660 Opaque cursor for the next page, or null if no more results.661662#### Example663664```bash665curl https://api.anthropic.com/v1/organizations/federation_issuers \666 -H 'anthropic-version: 2023-06-01' \667 -H "X-Api-Key: $ANTHROPIC_API_KEY"668```669670##### Response (200)671672```json673{674 "data": [675 {676 "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",677 "archived_at": "2019-12-27T18:11:19.117Z",678 "archived_by_actor_id": "archived_by_actor_id",679 "check_jti": true,680 "created_at": "2024-10-30T23:58:27.427722Z",681 "created_by_actor_id": "created_by_actor_id",682 "issuer_url": "https://token.actions.githubusercontent.com",683 "jwks": {684 "type": "discovery",685 "ca_cert_pem": "ca_cert_pem",686 "discovery_base": "discovery_base"687 },688 "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",689 "max_jwt_lifetime_seconds": 0,690 "name": "github-actions",691 "poll_status": {692 "consecutive_failures": 0,693 "last_fetched_at": "2019-12-27T18:11:19.117Z",694 "next_poll_at": "2019-12-27T18:11:19.117Z"695 },696 "type": "federation_issuer",697 "updated_at": "2024-10-30T23:58:27.427722Z",698 "updated_by_actor_id": "updated_by_actor_id"699 }700 ],701 "next_page": "next_page"702}703```704705### Get Federation Issuer706707**GET** `/v1/organizations/federation_issuers/{federation_issuer_id}`708709**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).710711Retrieve a federation issuer by its ID (`fdis_...`).712713#### Path parameters714715- `federation_issuer_id: string`716717 ID of the federation issuer.718719#### Headers720721- `"anthropic-beta": optional array of AnthropicBeta`722723 Optional header to specify the beta version(s) you want to use.724725 - `string`726727 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`728729 - `"message-batches-2024-09-24"`730731 - `"prompt-caching-2024-07-31"`732733 - `"computer-use-2024-10-22"`734735 - `"computer-use-2025-01-24"`736737 - `"pdfs-2024-09-25"`738739 - `"token-counting-2024-11-01"`740741 - `"token-efficient-tools-2025-02-19"`742743 - `"output-128k-2025-02-19"`744745 - `"files-api-2025-04-14"`746747 - `"mcp-client-2025-04-04"`748749 - `"mcp-client-2025-11-20"`750751 - `"dev-full-thinking-2025-05-14"`752753 - `"interleaved-thinking-2025-05-14"`754755 - `"code-execution-2025-05-22"`756757 - `"extended-cache-ttl-2025-04-11"`758759 - `"context-1m-2025-08-07"`760761 - `"context-management-2025-06-27"`762763 - `"model-context-window-exceeded-2025-08-26"`764765 - `"skills-2025-10-02"`766767 - `"fast-mode-2026-02-01"`768769 - `"output-300k-2026-03-24"`770771 - `"user-profiles-2026-03-24"`772773 - `"user-profiles-2026-08-18"`774775 - `"user-profiles-2026-09-04"`776777 - `"advisor-tool-2026-03-01"`778779 - `"managed-agents-2026-04-01"`780781 - `"cache-diagnosis-2026-04-07"`782783 - `"dreaming-2026-04-21"`784785 - `"thinking-token-count-2026-05-13"`786787 - `"server-side-fallback-2026-06-01"`788789 - `"server-side-fallback-2026-07-01"`790791 - `"fallback-credit-2026-06-01"`792793 - `"fallback-credit-2026-07-01"`794795 - `"agent-memory-2026-07-22"`796797 - `"mid-conversation-tool-changes-2026-07-01"`798799 - `"compact-2026-01-12"`800801 - `"computer-use-2025-11-24"`802803 - `"mcp-tunnels-2026-06-22"`804805 - `"structured-outputs-2025-11-13"`806807 - `"task-budgets-2026-03-13"`808809 - `"thinking-display-updates-2026-08-18"`810811 - `"ce-user-management-2026-07-13"`812813 - `"mid-conversation-output-config-2026-07-01"`814815 - `"thinking-binding-controls-2026-08-01"`816817 - `"mid-conversation-system-clear-at-2026-08-21"`818819 - `"compact-2026-09-04"`820821#### Returns822823- `BetaFederationIssuer object`824825 Registered external OIDC identity provider.826827 Records an external IdP the organization trusts for the RFC 7523828 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.829830 - `type: "federation_issuer"`831832 default: federation_issuer833834 - `id: string`835836 Tagged ID of the federation issuer.837838 - `archived_at: string or null`839840 If set, all rules referencing this issuer reject token exchange.841842 format: date-time843844 - `archived_by_actor_id: string or null`845846 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.847848 - `check_jti: boolean`849850 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.851852 - `created_at: string`853854 When this issuer was created.855856 format: date-time857858 - `created_by_actor_id: string or null`859860 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.861862 - `issuer_url: string`863864 The `iss` claim value. Incoming JWTs must match exactly.865866 - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`867868 How signing keys are obtained for signature verification.869870 - `BetaJWKSDiscovery object`871872 JWKS via the issuer's OIDC discovery document.873874 - `type: "discovery"`875876 - `ca_cert_pem: optional string or null`877878 Optional custom CA (PEM) for TLS verification of the JWKS fetch.879880 maxLength: 8192881882 - `discovery_base: optional string or null`883884 Set when the discovery URL differs from `issuer_url`.885886 - `BetaJWKSExplicitURL object`887888 JWKS fetched from a fixed endpoint.889890 - `type: "explicit_url"`891892 - `url: string`893894 JWKS endpoint.895896 minLength: 1897898 - `ca_cert_pem: optional string or null`899900 Optional custom CA (PEM) for TLS verification of the JWKS fetch.901902 maxLength: 8192903904 - `BetaJWKSInline object`905906 JWKS supplied directly; no network fetch.907908 - `type: "inline"`909910 - `keys: array of map[unknown]`911912 Inline JWK objects.913914 minItems: 1915916 - `jwks_polling_disabled_at: string or null`917918 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.919920 format: date-time921922 - `max_jwt_lifetime_seconds: number`923924 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.925926 - `name: string`927928 Admin-chosen slug identifier.929930 - `poll_status: BetaFederationIssuerPollStatus or null`931932 Status of automatic JWKS polling for a federation issuer.933934 Anthropic periodically fetches the issuer's signing keys in the935 background. These fields summarize the most recent fetches so the936 health of the JWKS endpoint can be monitored.937938 - `consecutive_failures: number`939940 Consecutive fetch failures since the last success.941942 - `last_fetched_at: string or null`943944 When the last successful fetch completed.945946 format: date-time947948 - `next_poll_at: string or null`949950 When the next fetch is scheduled. Null if paused.951952 format: date-time953954 - `updated_at: string`955956 When this issuer was last updated.957958 format: date-time959960 - `updated_by_actor_id: string or null`961962 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.963964#### Example965966```bash967curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \968 -H 'anthropic-version: 2023-06-01' \969 -H "X-Api-Key: $ANTHROPIC_API_KEY"970```971972##### Response (200)973974```json975{976 "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",977 "archived_at": "2019-12-27T18:11:19.117Z",978 "archived_by_actor_id": "archived_by_actor_id",979 "check_jti": true,980 "created_at": "2024-10-30T23:58:27.427722Z",981 "created_by_actor_id": "created_by_actor_id",982 "issuer_url": "https://token.actions.githubusercontent.com",983 "jwks": {984 "type": "discovery",985 "ca_cert_pem": "ca_cert_pem",986 "discovery_base": "discovery_base"987 },988 "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",989 "max_jwt_lifetime_seconds": 0,990 "name": "github-actions",991 "poll_status": {992 "consecutive_failures": 0,993 "last_fetched_at": "2019-12-27T18:11:19.117Z",994 "next_poll_at": "2019-12-27T18:11:19.117Z"995 },996 "type": "federation_issuer",997 "updated_at": "2024-10-30T23:58:27.427722Z",998 "updated_by_actor_id": "updated_by_actor_id"999}1000```10011002### Update Federation Issuer10031004**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`10051006**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).10071008Partially update a federation issuer.10091010Setting `jwks` replaces the full JWKS shape at once. Archived issuers1011cannot be updated; this returns 400. Create a new issuer instead.10121013Updating an issuer that backs a rule with a scope outside1014`workspace:developer` or `workspace:inference` requires a Console1015session.10161017#### Path parameters10181019- `federation_issuer_id: string`10201021 ID of the federation issuer to update.10221023#### Headers10241025- `"anthropic-beta": optional array of AnthropicBeta`10261027 Optional header to specify the beta version(s) you want to use.10281029 - `string`10301031 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`10321033 - `"message-batches-2024-09-24"`10341035 - `"prompt-caching-2024-07-31"`10361037 - `"computer-use-2024-10-22"`10381039 - `"computer-use-2025-01-24"`10401041 - `"pdfs-2024-09-25"`10421043 - `"token-counting-2024-11-01"`10441045 - `"token-efficient-tools-2025-02-19"`10461047 - `"output-128k-2025-02-19"`10481049 - `"files-api-2025-04-14"`10501051 - `"mcp-client-2025-04-04"`10521053 - `"mcp-client-2025-11-20"`10541055 - `"dev-full-thinking-2025-05-14"`10561057 - `"interleaved-thinking-2025-05-14"`10581059 - `"code-execution-2025-05-22"`10601061 - `"extended-cache-ttl-2025-04-11"`10621063 - `"context-1m-2025-08-07"`10641065 - `"context-management-2025-06-27"`10661067 - `"model-context-window-exceeded-2025-08-26"`10681069 - `"skills-2025-10-02"`10701071 - `"fast-mode-2026-02-01"`10721073 - `"output-300k-2026-03-24"`10741075 - `"user-profiles-2026-03-24"`10761077 - `"user-profiles-2026-08-18"`10781079 - `"user-profiles-2026-09-04"`10801081 - `"advisor-tool-2026-03-01"`10821083 - `"managed-agents-2026-04-01"`10841085 - `"cache-diagnosis-2026-04-07"`10861087 - `"dreaming-2026-04-21"`10881089 - `"thinking-token-count-2026-05-13"`10901091 - `"server-side-fallback-2026-06-01"`10921093 - `"server-side-fallback-2026-07-01"`10941095 - `"fallback-credit-2026-06-01"`10961097 - `"fallback-credit-2026-07-01"`10981099 - `"agent-memory-2026-07-22"`11001101 - `"mid-conversation-tool-changes-2026-07-01"`11021103 - `"compact-2026-01-12"`11041105 - `"computer-use-2025-11-24"`11061107 - `"mcp-tunnels-2026-06-22"`11081109 - `"structured-outputs-2025-11-13"`11101111 - `"task-budgets-2026-03-13"`11121113 - `"thinking-display-updates-2026-08-18"`11141115 - `"ce-user-management-2026-07-13"`11161117 - `"mid-conversation-output-config-2026-07-01"`11181119 - `"thinking-binding-controls-2026-08-01"`11201121 - `"mid-conversation-system-clear-at-2026-08-21"`11221123 - `"compact-2026-09-04"`11241125#### Body parameters11261127- `check_jti: optional boolean or null`11281129 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.11301131- `issuer_url: optional string or null`11321133 Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity.11341135 minLength: 111361137- `jwks: optional BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline or null`11381139 Replaces the entire JWKS configuration.11401141 - `BetaJWKSDiscovery object`11421143 JWKS via the issuer's OIDC discovery document.11441145 - `type: "discovery"`11461147 - `ca_cert_pem: optional string or null`11481149 Optional custom CA (PEM) for TLS verification of the JWKS fetch.11501151 maxLength: 819211521153 - `discovery_base: optional string or null`11541155 Set when the discovery URL differs from `issuer_url`.11561157 - `BetaJWKSExplicitURL object`11581159 JWKS fetched from a fixed endpoint.11601161 - `type: "explicit_url"`11621163 - `url: string`11641165 JWKS endpoint.11661167 minLength: 111681169 - `ca_cert_pem: optional string or null`11701171 Optional custom CA (PEM) for TLS verification of the JWKS fetch.11721173 maxLength: 819211741175 - `BetaJWKSInline object`11761177 JWKS supplied directly; no network fetch.11781179 - `type: "inline"`11801181 - `keys: array of map[unknown]`11821183 Inline JWK objects.11841185 minItems: 111861187- `jwks_polling_disabled: optional boolean or null`11881189 Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected.11901191- `max_jwt_lifetime_seconds: optional number or null`11921193 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.11941195 maximum: 176400, exclusiveMinimum: 011961197- `name: optional string or null`11981199 Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.12001201 maxLength: 255, minLength: 112021203#### Returns12041205- `BetaFederationIssuer object`12061207 Registered external OIDC identity provider.12081209 Records an external IdP the organization trusts for the RFC 75231210 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.12111212 - `type: "federation_issuer"`12131214 default: federation_issuer12151216 - `id: string`12171218 Tagged ID of the federation issuer.12191220 - `archived_at: string or null`12211222 If set, all rules referencing this issuer reject token exchange.12231224 format: date-time12251226 - `archived_by_actor_id: string or null`12271228 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.12291230 - `check_jti: boolean`12311232 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.12331234 - `created_at: string`12351236 When this issuer was created.12371238 format: date-time12391240 - `created_by_actor_id: string or null`12411242 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.12431244 - `issuer_url: string`12451246 The `iss` claim value. Incoming JWTs must match exactly.12471248 - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`12491250 How signing keys are obtained for signature verification.12511252 - `BetaJWKSDiscovery object`12531254 JWKS via the issuer's OIDC discovery document.12551256 - `type: "discovery"`12571258 - `ca_cert_pem: optional string or null`12591260 Optional custom CA (PEM) for TLS verification of the JWKS fetch.12611262 maxLength: 819212631264 - `discovery_base: optional string or null`12651266 Set when the discovery URL differs from `issuer_url`.12671268 - `BetaJWKSExplicitURL object`12691270 JWKS fetched from a fixed endpoint.12711272 - `type: "explicit_url"`12731274 - `url: string`12751276 JWKS endpoint.12771278 minLength: 112791280 - `ca_cert_pem: optional string or null`12811282 Optional custom CA (PEM) for TLS verification of the JWKS fetch.12831284 maxLength: 819212851286 - `BetaJWKSInline object`12871288 JWKS supplied directly; no network fetch.12891290 - `type: "inline"`12911292 - `keys: array of map[unknown]`12931294 Inline JWK objects.12951296 minItems: 112971298 - `jwks_polling_disabled_at: string or null`12991300 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.13011302 format: date-time13031304 - `max_jwt_lifetime_seconds: number`13051306 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.13071308 - `name: string`13091310 Admin-chosen slug identifier.13111312 - `poll_status: BetaFederationIssuerPollStatus or null`13131314 Status of automatic JWKS polling for a federation issuer.13151316 Anthropic periodically fetches the issuer's signing keys in the1317 background. These fields summarize the most recent fetches so the1318 health of the JWKS endpoint can be monitored.13191320 - `consecutive_failures: number`13211322 Consecutive fetch failures since the last success.13231324 - `last_fetched_at: string or null`13251326 When the last successful fetch completed.13271328 format: date-time13291330 - `next_poll_at: string or null`13311332 When the next fetch is scheduled. Null if paused.13331334 format: date-time13351336 - `updated_at: string`13371338 When this issuer was last updated.13391340 format: date-time13411342 - `updated_by_actor_id: string or null`13431344 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.13451346#### Example13471348```bash1349curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \1350 -H 'Content-Type: application/json' \1351 -H 'anthropic-version: 2023-06-01' \1352 -H "X-Api-Key: $ANTHROPIC_API_KEY" \1353 -d '{}'1354```13551356##### Response (200)13571358```json1359{1360 "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",1361 "archived_at": "2019-12-27T18:11:19.117Z",1362 "archived_by_actor_id": "archived_by_actor_id",1363 "check_jti": true,1364 "created_at": "2024-10-30T23:58:27.427722Z",1365 "created_by_actor_id": "created_by_actor_id",1366 "issuer_url": "https://token.actions.githubusercontent.com",1367 "jwks": {1368 "type": "discovery",1369 "ca_cert_pem": "ca_cert_pem",1370 "discovery_base": "discovery_base"1371 },1372 "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",1373 "max_jwt_lifetime_seconds": 0,1374 "name": "github-actions",1375 "poll_status": {1376 "consecutive_failures": 0,1377 "last_fetched_at": "2019-12-27T18:11:19.117Z",1378 "next_poll_at": "2019-12-27T18:11:19.117Z"1379 },1380 "type": "federation_issuer",1381 "updated_at": "2024-10-30T23:58:27.427722Z",1382 "updated_by_actor_id": "updated_by_actor_id"1383}1384```13851386### Archive Federation Issuer13871388**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`13891390**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).13911392Archive a federation issuer.13931394Idempotent; re-archiving returns the issuer with its original1395`archived_at`. Rejected with 400 if any live (non-archived) federation1396rule still references the issuer; archive those rules first (a rule's1397issuer cannot be changed), or recreate them against another issuer.13981399#### Path parameters14001401- `federation_issuer_id: string`14021403 ID of the federation issuer to archive.14041405#### Headers14061407- `"anthropic-beta": optional array of AnthropicBeta`14081409 Optional header to specify the beta version(s) you want to use.14101411 - `string`14121413 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`14141415 - `"message-batches-2024-09-24"`14161417 - `"prompt-caching-2024-07-31"`14181419 - `"computer-use-2024-10-22"`14201421 - `"computer-use-2025-01-24"`14221423 - `"pdfs-2024-09-25"`14241425 - `"token-counting-2024-11-01"`14261427 - `"token-efficient-tools-2025-02-19"`14281429 - `"output-128k-2025-02-19"`14301431 - `"files-api-2025-04-14"`14321433 - `"mcp-client-2025-04-04"`14341435 - `"mcp-client-2025-11-20"`14361437 - `"dev-full-thinking-2025-05-14"`14381439 - `"interleaved-thinking-2025-05-14"`14401441 - `"code-execution-2025-05-22"`14421443 - `"extended-cache-ttl-2025-04-11"`14441445 - `"context-1m-2025-08-07"`14461447 - `"context-management-2025-06-27"`14481449 - `"model-context-window-exceeded-2025-08-26"`14501451 - `"skills-2025-10-02"`14521453 - `"fast-mode-2026-02-01"`14541455 - `"output-300k-2026-03-24"`14561457 - `"user-profiles-2026-03-24"`14581459 - `"user-profiles-2026-08-18"`14601461 - `"user-profiles-2026-09-04"`14621463 - `"advisor-tool-2026-03-01"`14641465 - `"managed-agents-2026-04-01"`14661467 - `"cache-diagnosis-2026-04-07"`14681469 - `"dreaming-2026-04-21"`14701471 - `"thinking-token-count-2026-05-13"`14721473 - `"server-side-fallback-2026-06-01"`14741475 - `"server-side-fallback-2026-07-01"`14761477 - `"fallback-credit-2026-06-01"`14781479 - `"fallback-credit-2026-07-01"`14801481 - `"agent-memory-2026-07-22"`14821483 - `"mid-conversation-tool-changes-2026-07-01"`14841485 - `"compact-2026-01-12"`14861487 - `"computer-use-2025-11-24"`14881489 - `"mcp-tunnels-2026-06-22"`14901491 - `"structured-outputs-2025-11-13"`14921493 - `"task-budgets-2026-03-13"`14941495 - `"thinking-display-updates-2026-08-18"`14961497 - `"ce-user-management-2026-07-13"`14981499 - `"mid-conversation-output-config-2026-07-01"`15001501 - `"thinking-binding-controls-2026-08-01"`15021503 - `"mid-conversation-system-clear-at-2026-08-21"`15041505 - `"compact-2026-09-04"`15061507#### Returns15081509- `BetaFederationIssuer object`15101511 Registered external OIDC identity provider.15121513 Records an external IdP the organization trusts for the RFC 75231514 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.15151516 - `type: "federation_issuer"`15171518 default: federation_issuer15191520 - `id: string`15211522 Tagged ID of the federation issuer.15231524 - `archived_at: string or null`15251526 If set, all rules referencing this issuer reject token exchange.15271528 format: date-time15291530 - `archived_by_actor_id: string or null`15311532 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.15331534 - `check_jti: boolean`15351536 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.15371538 - `created_at: string`15391540 When this issuer was created.15411542 format: date-time15431544 - `created_by_actor_id: string or null`15451546 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.15471548 - `issuer_url: string`15491550 The `iss` claim value. Incoming JWTs must match exactly.15511552 - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`15531554 How signing keys are obtained for signature verification.15551556 - `BetaJWKSDiscovery object`15571558 JWKS via the issuer's OIDC discovery document.15591560 - `type: "discovery"`15611562 - `ca_cert_pem: optional string or null`15631564 Optional custom CA (PEM) for TLS verification of the JWKS fetch.15651566 maxLength: 819215671568 - `discovery_base: optional string or null`15691570 Set when the discovery URL differs from `issuer_url`.15711572 - `BetaJWKSExplicitURL object`15731574 JWKS fetched from a fixed endpoint.15751576 - `type: "explicit_url"`15771578 - `url: string`15791580 JWKS endpoint.15811582 minLength: 115831584 - `ca_cert_pem: optional string or null`15851586 Optional custom CA (PEM) for TLS verification of the JWKS fetch.15871588 maxLength: 819215891590 - `BetaJWKSInline object`15911592 JWKS supplied directly; no network fetch.15931594 - `type: "inline"`15951596 - `keys: array of map[unknown]`15971598 Inline JWK objects.15991600 minItems: 116011602 - `jwks_polling_disabled_at: string or null`16031604 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.16051606 format: date-time16071608 - `max_jwt_lifetime_seconds: number`16091610 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.16111612 - `name: string`16131614 Admin-chosen slug identifier.16151616 - `poll_status: BetaFederationIssuerPollStatus or null`16171618 Status of automatic JWKS polling for a federation issuer.16191620 Anthropic periodically fetches the issuer's signing keys in the1621 background. These fields summarize the most recent fetches so the1622 health of the JWKS endpoint can be monitored.16231624 - `consecutive_failures: number`16251626 Consecutive fetch failures since the last success.16271628 - `last_fetched_at: string or null`16291630 When the last successful fetch completed.16311632 format: date-time16331634 - `next_poll_at: string or null`16351636 When the next fetch is scheduled. Null if paused.16371638 format: date-time16391640 - `updated_at: string`16411642 When this issuer was last updated.16431644 format: date-time16451646 - `updated_by_actor_id: string or null`16471648 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.16491650#### Example16511652```bash1653curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID/archive \1654 -X POST \1655 -H 'anthropic-version: 2023-06-01' \1656 -H "X-Api-Key: $ANTHROPIC_API_KEY"1657```16581659##### Response (200)16601661```json1662{1663 "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",1664 "archived_at": "2019-12-27T18:11:19.117Z",1665 "archived_by_actor_id": "archived_by_actor_id",1666 "check_jti": true,1667 "created_at": "2024-10-30T23:58:27.427722Z",1668 "created_by_actor_id": "created_by_actor_id",1669 "issuer_url": "https://token.actions.githubusercontent.com",1670 "jwks": {1671 "type": "discovery",1672 "ca_cert_pem": "ca_cert_pem",1673 "discovery_base": "discovery_base"1674 },1675 "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",1676 "max_jwt_lifetime_seconds": 0,1677 "name": "github-actions",1678 "poll_status": {1679 "consecutive_failures": 0,1680 "last_fetched_at": "2019-12-27T18:11:19.117Z",1681 "next_poll_at": "2019-12-27T18:11:19.117Z"1682 },1683 "type": "federation_issuer",1684 "updated_at": "2024-10-30T23:58:27.427722Z",1685 "updated_by_actor_id": "updated_by_actor_id"1686}1687```16881689## Federation › Rules16901691### Create Federation Rule16921693**POST** `/v1/organizations/federation_rules`16941695**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).16961697Create a federation rule owned by your organization.16981699The referenced issuer and the target service account must already exist1700in the same organization; invalid references are rejected with a 4001701error. The workspace reference is validated. Membership is not checked1702at rule creation: token exchange resolves a single enabled workspace per1703call and is rejected unless the target service account is a member of1704that workspace (it is implicitly a member of the default workspace).1705Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite,1706Terraform Cloud, Google) must constrain tenant identity via an1707identity-bearing claim, a tenant-pinning subject prefix (such as1708`repo:YOUR_ORG/...`), or a CEL condition referencing one of those1709identity claims (e.g. `claims.repository_owner`). OAuth callers may only1710manage rules whose `oauth_scope` is `workspace:developer` or1711`workspace:inference`; other scopes require a Console session.17121713#### Headers17141715- `"anthropic-beta": optional array of AnthropicBeta`17161717 Optional header to specify the beta version(s) you want to use.17181719 - `string`17201721 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`17221723 - `"message-batches-2024-09-24"`17241725 - `"prompt-caching-2024-07-31"`17261727 - `"computer-use-2024-10-22"`17281729 - `"computer-use-2025-01-24"`17301731 - `"pdfs-2024-09-25"`17321733 - `"token-counting-2024-11-01"`17341735 - `"token-efficient-tools-2025-02-19"`17361737 - `"output-128k-2025-02-19"`17381739 - `"files-api-2025-04-14"`17401741 - `"mcp-client-2025-04-04"`17421743 - `"mcp-client-2025-11-20"`17441745 - `"dev-full-thinking-2025-05-14"`17461747 - `"interleaved-thinking-2025-05-14"`17481749 - `"code-execution-2025-05-22"`17501751 - `"extended-cache-ttl-2025-04-11"`17521753 - `"context-1m-2025-08-07"`17541755 - `"context-management-2025-06-27"`17561757 - `"model-context-window-exceeded-2025-08-26"`17581759 - `"skills-2025-10-02"`17601761 - `"fast-mode-2026-02-01"`17621763 - `"output-300k-2026-03-24"`17641765 - `"user-profiles-2026-03-24"`17661767 - `"user-profiles-2026-08-18"`17681769 - `"user-profiles-2026-09-04"`17701771 - `"advisor-tool-2026-03-01"`17721773 - `"managed-agents-2026-04-01"`17741775 - `"cache-diagnosis-2026-04-07"`17761777 - `"dreaming-2026-04-21"`17781779 - `"thinking-token-count-2026-05-13"`17801781 - `"server-side-fallback-2026-06-01"`17821783 - `"server-side-fallback-2026-07-01"`17841785 - `"fallback-credit-2026-06-01"`17861787 - `"fallback-credit-2026-07-01"`17881789 - `"agent-memory-2026-07-22"`17901791 - `"mid-conversation-tool-changes-2026-07-01"`17921793 - `"compact-2026-01-12"`17941795 - `"computer-use-2025-11-24"`17961797 - `"mcp-tunnels-2026-06-22"`17981799 - `"structured-outputs-2025-11-13"`18001801 - `"task-budgets-2026-03-13"`18021803 - `"thinking-display-updates-2026-08-18"`18041805 - `"ce-user-management-2026-07-13"`18061807 - `"mid-conversation-output-config-2026-07-01"`18081809 - `"thinking-binding-controls-2026-08-01"`18101811 - `"mid-conversation-system-clear-at-2026-08-21"`18121813 - `"compact-2026-09-04"`18141815#### Body parameters18161817- `issuer_id: string`18181819 Tagged ID of the federation issuer.18201821- `match: BetaFederationRuleMatch`18221823 Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.18241825 - `audience: optional string or null`18261827 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.18281829 maxLength: 102418301831 - `claims: optional map[string] or null`18321833 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.18341835 - `condition: optional string or null`18361837 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.18381839 maxLength: 409618401841 - `subject_prefix: optional string or null`18421843 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.18441845 maxLength: 102418461847- `name: string`18481849 Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.18501851 maxLength: 255, minLength: 118521853- `oauth_scope: string`18541855 Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.18561857 minLength: 118581859- `target: BetaServiceAccountTarget`18601861 Identity that tokens minted via this rule act as. Currently always a `service_account` target.18621863 - `type: "service_account"`18641865 - `service_account_id: string`18661867 Tagged ID of the service account to mint tokens for.18681869 - `service_account_name: optional string or null`18701871 Service account's display name at read time. Ignored on writes.18721873- `applies_to_all_workspaces: optional boolean`18741875 When true, enable this rule for every workspace in the org (including workspaces created later).18761877- `attributes: optional map[string] or null`18781879 CEL expressions `{name: expr}` extracting named values from claims. Not yet supported; any non-empty value is rejected with 400.18801881- `description: optional string or null`18821883 Optional free-text description.18841885 maxLength: 200018861887- `token_lifetime_seconds: optional number`18881889 Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.18901891 maximum: 86400, minimum: 6018921893- `workspace_id: optional string or null`18941895 Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.18961897#### Returns18981899- `BetaFederationRule object`19001901 Authorization rule binding an external OIDC identity to Anthropic.19021903 Evaluates the match conditions and mints an OAuth access token for the1904 resolved target, scoped to a single workspace where the rule is enabled1905 (chosen by the caller at exchange time when the rule is enabled for more1906 than one). For rules enabled via `workspace_ids` or1907 `applies_to_all_workspaces`, the target service account must be a member1908 of that workspace (it is implicitly a member of the default workspace);1909 rules carrying only the legacy `workspace_id` binding do not enforce1910 this.19111912 - `type: "federation_rule"`19131914 default: federation_rule19151916 - `id: string`19171918 Tagged ID of the federation rule.19191920 - `applies_to_all_workspaces: boolean`19211922 When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.19231924 - `archived_at: string or null`19251926 If set, this rule is archived and rejects token exchange.19271928 format: date-time19291930 - `archived_by_actor_id: string or null`19311932 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.19331934 - `attributes: map[string] or null`19351936 CEL expressions extracting named values from claims. Not yet supported; always null.19371938 - `created_at: string`19391940 When this rule was created.19411942 format: date-time19431944 - `created_by_actor_id: string or null`19451946 Tagged ID (`user_`/`svac_`) of the actor that created this rule.19471948 - `description: string or null`19491950 Optional free-text description.19511952 - `issuer_id: string`19531954 Tagged ID of the issuer whose tokens this rule accepts.19551956 - `issuer_name: string or null`19571958 Issuer's display name at read time.19591960 - `match: BetaFederationRuleMatch`19611962 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.19631964 - `audience: optional string or null`19651966 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.19671968 maxLength: 102419691970 - `claims: optional map[string] or null`19711972 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.19731974 - `condition: optional string or null`19751976 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.19771978 maxLength: 409619791980 - `subject_prefix: optional string or null`19811982 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.19831984 maxLength: 102419851986 - `name: string`19871988 Admin-chosen slug identifier.19891990 - `oauth_scope: string`19911992 Space-separated OAuth scopes granted on the minted token.19931994 - `target: BetaServiceAccountTarget`19951996 Identity that tokens minted via this rule act as. Currently always a `service_account` target.19971998 - `type: "service_account"`19992000 - `service_account_id: string`20012002 Tagged ID of the service account to mint tokens for.20032004 - `service_account_name: optional string or null`20052006 Service account's display name at read time. Ignored on writes.20072008 - `token_lifetime_seconds: number`20092010 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.20112012 - `updated_at: string`20132014 When this rule was last updated.20152016 format: date-time20172018 - `updated_by_actor_id: string or null`20192020 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.20212022 - `workspace_id: string or null`20232024 Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.20252026 - `workspace_ids: array of string`20272028 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).20292030#### Example20312032```bash2033curl https://api.anthropic.com/v1/organizations/federation_rules \2034 -H 'Content-Type: application/json' \2035 -H 'anthropic-version: 2023-06-01' \2036 -H "X-Api-Key: $ANTHROPIC_API_KEY" \2037 -d '{2038 "issuer_id": "issuer_id",2039 "match": {},2040 "name": "x",2041 "oauth_scope": "x",2042 "target": {2043 "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",2044 "type": "service_account"2045 }2046 }'2047```20482049##### Response (200)20502051```json2052{2053 "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",2054 "applies_to_all_workspaces": true,2055 "archived_at": "2019-12-27T18:11:19.117Z",2056 "archived_by_actor_id": "archived_by_actor_id",2057 "attributes": {2058 "foo": "string"2059 },2060 "created_at": "2024-10-30T23:58:27.427722Z",2061 "created_by_actor_id": "created_by_actor_id",2062 "description": "description",2063 "issuer_id": "issuer_id",2064 "issuer_name": "issuer_name",2065 "match": {2066 "audience": "audience",2067 "claims": {2068 "foo": "string"2069 },2070 "condition": "condition",2071 "subject_prefix": "subject_prefix"2072 },2073 "name": "prod-deploy-pipeline",2074 "oauth_scope": "oauth_scope",2075 "target": {2076 "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",2077 "type": "service_account",2078 "service_account_name": "service_account_name"2079 },2080 "token_lifetime_seconds": 0,2081 "type": "federation_rule",2082 "updated_at": "2024-10-30T23:58:27.427722Z",2083 "updated_by_actor_id": "updated_by_actor_id",2084 "workspace_id": "workspace_id",2085 "workspace_ids": [2086 "string"2087 ]2088}2089```20902091### List Federation Rules20922093**GET** `/v1/organizations/federation_rules`20942095**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).20962097List federation rules in your organization.20982099Optionally filter by issuer with `issuer_id`. Archived rules are excluded2100unless `include_archived=true`.21012102#### Query parameters21032104- `include_archived: optional boolean`21052106 Include archived resources. Defaults to false.21072108 default: false21092110- `issuer_id: optional string`21112112 Filter to rules referencing this federation issuer.21132114- `limit: optional number`21152116 Number of results per page.21172118 default: 20, maximum: 100, minimum: 121192120- `page: optional string`21212122 Opaque cursor from a previous response's `next_page`.21232124#### Headers21252126- `"anthropic-beta": optional array of AnthropicBeta`21272128 Optional header to specify the beta version(s) you want to use.21292130 - `string`21312132 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`21332134 - `"message-batches-2024-09-24"`21352136 - `"prompt-caching-2024-07-31"`21372138 - `"computer-use-2024-10-22"`21392140 - `"computer-use-2025-01-24"`21412142 - `"pdfs-2024-09-25"`21432144 - `"token-counting-2024-11-01"`21452146 - `"token-efficient-tools-2025-02-19"`21472148 - `"output-128k-2025-02-19"`21492150 - `"files-api-2025-04-14"`21512152 - `"mcp-client-2025-04-04"`21532154 - `"mcp-client-2025-11-20"`21552156 - `"dev-full-thinking-2025-05-14"`21572158 - `"interleaved-thinking-2025-05-14"`21592160 - `"code-execution-2025-05-22"`21612162 - `"extended-cache-ttl-2025-04-11"`21632164 - `"context-1m-2025-08-07"`21652166 - `"context-management-2025-06-27"`21672168 - `"model-context-window-exceeded-2025-08-26"`21692170 - `"skills-2025-10-02"`21712172 - `"fast-mode-2026-02-01"`21732174 - `"output-300k-2026-03-24"`21752176 - `"user-profiles-2026-03-24"`21772178 - `"user-profiles-2026-08-18"`21792180 - `"user-profiles-2026-09-04"`21812182 - `"advisor-tool-2026-03-01"`21832184 - `"managed-agents-2026-04-01"`21852186 - `"cache-diagnosis-2026-04-07"`21872188 - `"dreaming-2026-04-21"`21892190 - `"thinking-token-count-2026-05-13"`21912192 - `"server-side-fallback-2026-06-01"`21932194 - `"server-side-fallback-2026-07-01"`21952196 - `"fallback-credit-2026-06-01"`21972198 - `"fallback-credit-2026-07-01"`21992200 - `"agent-memory-2026-07-22"`22012202 - `"mid-conversation-tool-changes-2026-07-01"`22032204 - `"compact-2026-01-12"`22052206 - `"computer-use-2025-11-24"`22072208 - `"mcp-tunnels-2026-06-22"`22092210 - `"structured-outputs-2025-11-13"`22112212 - `"task-budgets-2026-03-13"`22132214 - `"thinking-display-updates-2026-08-18"`22152216 - `"ce-user-management-2026-07-13"`22172218 - `"mid-conversation-output-config-2026-07-01"`22192220 - `"thinking-binding-controls-2026-08-01"`22212222 - `"mid-conversation-system-clear-at-2026-08-21"`22232224 - `"compact-2026-09-04"`22252226#### Returns22272228- `data: array of BetaFederationRule`22292230 - `type: "federation_rule"`22312232 default: federation_rule22332234 - `id: string`22352236 Tagged ID of the federation rule.22372238 - `applies_to_all_workspaces: boolean`22392240 When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.22412242 - `archived_at: string or null`22432244 If set, this rule is archived and rejects token exchange.22452246 format: date-time22472248 - `archived_by_actor_id: string or null`22492250 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.22512252 - `attributes: map[string] or null`22532254 CEL expressions extracting named values from claims. Not yet supported; always null.22552256 - `created_at: string`22572258 When this rule was created.22592260 format: date-time22612262 - `created_by_actor_id: string or null`22632264 Tagged ID (`user_`/`svac_`) of the actor that created this rule.22652266 - `description: string or null`22672268 Optional free-text description.22692270 - `issuer_id: string`22712272 Tagged ID of the issuer whose tokens this rule accepts.22732274 - `issuer_name: string or null`22752276 Issuer's display name at read time.22772278 - `match: BetaFederationRuleMatch`22792280 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.22812282 - `audience: optional string or null`22832284 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.22852286 maxLength: 102422872288 - `claims: optional map[string] or null`22892290 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.22912292 - `condition: optional string or null`22932294 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.22952296 maxLength: 409622972298 - `subject_prefix: optional string or null`22992300 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.23012302 maxLength: 102423032304 - `name: string`23052306 Admin-chosen slug identifier.23072308 - `oauth_scope: string`23092310 Space-separated OAuth scopes granted on the minted token.23112312 - `target: BetaServiceAccountTarget`23132314 Identity that tokens minted via this rule act as. Currently always a `service_account` target.23152316 - `type: "service_account"`23172318 - `service_account_id: string`23192320 Tagged ID of the service account to mint tokens for.23212322 - `service_account_name: optional string or null`23232324 Service account's display name at read time. Ignored on writes.23252326 - `token_lifetime_seconds: number`23272328 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.23292330 - `updated_at: string`23312332 When this rule was last updated.23332334 format: date-time23352336 - `updated_by_actor_id: string or null`23372338 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.23392340 - `workspace_id: string or null`23412342 Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.23432344 - `workspace_ids: array of string`23452346 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).23472348- `next_page: string or null`23492350 Opaque cursor for the next page, or null if no more results.23512352#### Example23532354```bash2355curl https://api.anthropic.com/v1/organizations/federation_rules \2356 -H 'anthropic-version: 2023-06-01' \2357 -H "X-Api-Key: $ANTHROPIC_API_KEY"2358```23592360##### Response (200)23612362```json2363{2364 "data": [2365 {2366 "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",2367 "applies_to_all_workspaces": true,2368 "archived_at": "2019-12-27T18:11:19.117Z",2369 "archived_by_actor_id": "archived_by_actor_id",2370 "attributes": {2371 "foo": "string"2372 },2373 "created_at": "2024-10-30T23:58:27.427722Z",2374 "created_by_actor_id": "created_by_actor_id",2375 "description": "description",2376 "issuer_id": "issuer_id",2377 "issuer_name": "issuer_name",2378 "match": {2379 "audience": "audience",2380 "claims": {2381 "foo": "string"2382 },2383 "condition": "condition",2384 "subject_prefix": "subject_prefix"2385 },2386 "name": "prod-deploy-pipeline",2387 "oauth_scope": "oauth_scope",2388 "target": {2389 "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",2390 "type": "service_account",2391 "service_account_name": "service_account_name"2392 },2393 "token_lifetime_seconds": 0,2394 "type": "federation_rule",2395 "updated_at": "2024-10-30T23:58:27.427722Z",2396 "updated_by_actor_id": "updated_by_actor_id",2397 "workspace_id": "workspace_id",2398 "workspace_ids": [2399 "string"2400 ]2401 }2402 ],2403 "next_page": "next_page"2404}2405```24062407### Get Federation Rule24082409**GET** `/v1/organizations/federation_rules/{federation_rule_id}`24102411**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).24122413Retrieve a federation rule by its ID (`fdrl_...`).24142415#### Path parameters24162417- `federation_rule_id: string`24182419 ID of the federation rule.24202421#### Headers24222423- `"anthropic-beta": optional array of AnthropicBeta`24242425 Optional header to specify the beta version(s) you want to use.24262427 - `string`24282429 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`24302431 - `"message-batches-2024-09-24"`24322433 - `"prompt-caching-2024-07-31"`24342435 - `"computer-use-2024-10-22"`24362437 - `"computer-use-2025-01-24"`24382439 - `"pdfs-2024-09-25"`24402441 - `"token-counting-2024-11-01"`24422443 - `"token-efficient-tools-2025-02-19"`24442445 - `"output-128k-2025-02-19"`24462447 - `"files-api-2025-04-14"`24482449 - `"mcp-client-2025-04-04"`24502451 - `"mcp-client-2025-11-20"`24522453 - `"dev-full-thinking-2025-05-14"`24542455 - `"interleaved-thinking-2025-05-14"`24562457 - `"code-execution-2025-05-22"`24582459 - `"extended-cache-ttl-2025-04-11"`24602461 - `"context-1m-2025-08-07"`24622463 - `"context-management-2025-06-27"`24642465 - `"model-context-window-exceeded-2025-08-26"`24662467 - `"skills-2025-10-02"`24682469 - `"fast-mode-2026-02-01"`24702471 - `"output-300k-2026-03-24"`24722473 - `"user-profiles-2026-03-24"`24742475 - `"user-profiles-2026-08-18"`24762477 - `"user-profiles-2026-09-04"`24782479 - `"advisor-tool-2026-03-01"`24802481 - `"managed-agents-2026-04-01"`24822483 - `"cache-diagnosis-2026-04-07"`24842485 - `"dreaming-2026-04-21"`24862487 - `"thinking-token-count-2026-05-13"`24882489 - `"server-side-fallback-2026-06-01"`24902491 - `"server-side-fallback-2026-07-01"`24922493 - `"fallback-credit-2026-06-01"`24942495 - `"fallback-credit-2026-07-01"`24962497 - `"agent-memory-2026-07-22"`24982499 - `"mid-conversation-tool-changes-2026-07-01"`25002501 - `"compact-2026-01-12"`25022503 - `"computer-use-2025-11-24"`25042505 - `"mcp-tunnels-2026-06-22"`25062507 - `"structured-outputs-2025-11-13"`25082509 - `"task-budgets-2026-03-13"`25102511 - `"thinking-display-updates-2026-08-18"`25122513 - `"ce-user-management-2026-07-13"`25142515 - `"mid-conversation-output-config-2026-07-01"`25162517 - `"thinking-binding-controls-2026-08-01"`25182519 - `"mid-conversation-system-clear-at-2026-08-21"`25202521 - `"compact-2026-09-04"`25222523#### Returns25242525- `BetaFederationRule object`25262527 Authorization rule binding an external OIDC identity to Anthropic.25282529 Evaluates the match conditions and mints an OAuth access token for the2530 resolved target, scoped to a single workspace where the rule is enabled2531 (chosen by the caller at exchange time when the rule is enabled for more2532 than one). For rules enabled via `workspace_ids` or2533 `applies_to_all_workspaces`, the target service account must be a member2534 of that workspace (it is implicitly a member of the default workspace);2535 rules carrying only the legacy `workspace_id` binding do not enforce2536 this.25372538 - `type: "federation_rule"`25392540 default: federation_rule25412542 - `id: string`25432544 Tagged ID of the federation rule.25452546 - `applies_to_all_workspaces: boolean`25472548 When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.25492550 - `archived_at: string or null`25512552 If set, this rule is archived and rejects token exchange.25532554 format: date-time25552556 - `archived_by_actor_id: string or null`25572558 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.25592560 - `attributes: map[string] or null`25612562 CEL expressions extracting named values from claims. Not yet supported; always null.25632564 - `created_at: string`25652566 When this rule was created.25672568 format: date-time25692570 - `created_by_actor_id: string or null`25712572 Tagged ID (`user_`/`svac_`) of the actor that created this rule.25732574 - `description: string or null`25752576 Optional free-text description.25772578 - `issuer_id: string`25792580 Tagged ID of the issuer whose tokens this rule accepts.25812582 - `issuer_name: string or null`25832584 Issuer's display name at read time.25852586 - `match: BetaFederationRuleMatch`25872588 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.25892590 - `audience: optional string or null`25912592 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.25932594 maxLength: 102425952596 - `claims: optional map[string] or null`25972598 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.25992600 - `condition: optional string or null`26012602 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.26032604 maxLength: 409626052606 - `subject_prefix: optional string or null`26072608 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.26092610 maxLength: 102426112612 - `name: string`26132614 Admin-chosen slug identifier.26152616 - `oauth_scope: string`26172618 Space-separated OAuth scopes granted on the minted token.26192620 - `target: BetaServiceAccountTarget`26212622 Identity that tokens minted via this rule act as. Currently always a `service_account` target.26232624 - `type: "service_account"`26252626 - `service_account_id: string`26272628 Tagged ID of the service account to mint tokens for.26292630 - `service_account_name: optional string or null`26312632 Service account's display name at read time. Ignored on writes.26332634 - `token_lifetime_seconds: number`26352636 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.26372638 - `updated_at: string`26392640 When this rule was last updated.26412642 format: date-time26432644 - `updated_by_actor_id: string or null`26452646 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.26472648 - `workspace_id: string or null`26492650 Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.26512652 - `workspace_ids: array of string`26532654 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).26552656#### Example26572658```bash2659curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \2660 -H 'anthropic-version: 2023-06-01' \2661 -H "X-Api-Key: $ANTHROPIC_API_KEY"2662```26632664##### Response (200)26652666```json2667{2668 "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",2669 "applies_to_all_workspaces": true,2670 "archived_at": "2019-12-27T18:11:19.117Z",2671 "archived_by_actor_id": "archived_by_actor_id",2672 "attributes": {2673 "foo": "string"2674 },2675 "created_at": "2024-10-30T23:58:27.427722Z",2676 "created_by_actor_id": "created_by_actor_id",2677 "description": "description",2678 "issuer_id": "issuer_id",2679 "issuer_name": "issuer_name",2680 "match": {2681 "audience": "audience",2682 "claims": {2683 "foo": "string"2684 },2685 "condition": "condition",2686 "subject_prefix": "subject_prefix"2687 },2688 "name": "prod-deploy-pipeline",2689 "oauth_scope": "oauth_scope",2690 "target": {2691 "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",2692 "type": "service_account",2693 "service_account_name": "service_account_name"2694 },2695 "token_lifetime_seconds": 0,2696 "type": "federation_rule",2697 "updated_at": "2024-10-30T23:58:27.427722Z",2698 "updated_by_actor_id": "updated_by_actor_id",2699 "workspace_id": "workspace_id",2700 "workspace_ids": [2701 "string"2702 ]2703}2704```27052706### Update Federation Rule27072708**POST** `/v1/organizations/federation_rules/{federation_rule_id}`27092710**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).27112712Partially update a federation rule.27132714`issuer_id` is immutable. `match` and `target` are replaced as whole2715objects when set. Referenced service accounts and workspaces must exist2716in your organization; invalid references are rejected with a 400 error.2717Archived rules cannot be updated; this returns 400. Create a new rule2718instead. Rules on well-known shared issuers (GitHub Actions, GitLab,2719Buildkite, Terraform Cloud, Google) must constrain tenant identity via2720an identity-bearing claim, a tenant-pinning subject prefix (such as2721`repo:YOUR_ORG/...`), or a CEL condition referencing one of those2722identity claims (e.g. `claims.repository_owner`). On these issuers the2723requirement is re-checked on every update; if an existing rule's stored2724match does not yet constrain tenant identity, any update (even a rename2725or description change) must also supply a conforming `match` in the same2726request. OAuth callers may only manage rules whose `oauth_scope` is2727`workspace:developer` or `workspace:inference`; other scopes require a2728Console session.27292730#### Path parameters27312732- `federation_rule_id: string`27332734 ID of the federation rule to update.27352736#### Headers27372738- `"anthropic-beta": optional array of AnthropicBeta`27392740 Optional header to specify the beta version(s) you want to use.27412742 - `string`27432744 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`27452746 - `"message-batches-2024-09-24"`27472748 - `"prompt-caching-2024-07-31"`27492750 - `"computer-use-2024-10-22"`27512752 - `"computer-use-2025-01-24"`27532754 - `"pdfs-2024-09-25"`27552756 - `"token-counting-2024-11-01"`27572758 - `"token-efficient-tools-2025-02-19"`27592760 - `"output-128k-2025-02-19"`27612762 - `"files-api-2025-04-14"`27632764 - `"mcp-client-2025-04-04"`27652766 - `"mcp-client-2025-11-20"`27672768 - `"dev-full-thinking-2025-05-14"`27692770 - `"interleaved-thinking-2025-05-14"`27712772 - `"code-execution-2025-05-22"`27732774 - `"extended-cache-ttl-2025-04-11"`27752776 - `"context-1m-2025-08-07"`27772778 - `"context-management-2025-06-27"`27792780 - `"model-context-window-exceeded-2025-08-26"`27812782 - `"skills-2025-10-02"`27832784 - `"fast-mode-2026-02-01"`27852786 - `"output-300k-2026-03-24"`27872788 - `"user-profiles-2026-03-24"`27892790 - `"user-profiles-2026-08-18"`27912792 - `"user-profiles-2026-09-04"`27932794 - `"advisor-tool-2026-03-01"`27952796 - `"managed-agents-2026-04-01"`27972798 - `"cache-diagnosis-2026-04-07"`27992800 - `"dreaming-2026-04-21"`28012802 - `"thinking-token-count-2026-05-13"`28032804 - `"server-side-fallback-2026-06-01"`28052806 - `"server-side-fallback-2026-07-01"`28072808 - `"fallback-credit-2026-06-01"`28092810 - `"fallback-credit-2026-07-01"`28112812 - `"agent-memory-2026-07-22"`28132814 - `"mid-conversation-tool-changes-2026-07-01"`28152816 - `"compact-2026-01-12"`28172818 - `"computer-use-2025-11-24"`28192820 - `"mcp-tunnels-2026-06-22"`28212822 - `"structured-outputs-2025-11-13"`28232824 - `"task-budgets-2026-03-13"`28252826 - `"thinking-display-updates-2026-08-18"`28272828 - `"ce-user-management-2026-07-13"`28292830 - `"mid-conversation-output-config-2026-07-01"`28312832 - `"thinking-binding-controls-2026-08-01"`28332834 - `"mid-conversation-system-clear-at-2026-08-21"`28352836 - `"compact-2026-09-04"`28372838#### Body parameters28392840- `applies_to_all_workspaces: optional boolean or null`28412842 When true, enables this rule for every workspace in the org (including workspaces created later). Setting `false` is rejected with 400 if no workspace would remain enabled; a rule with only a legacy `workspace_id` binding continues to mint.28432844- `attributes: optional map[string] or null`28452846 Replaces the CEL expressions `{name: expr}` extracting named values from claims. Send null to clear them. Not yet supported; any non-empty value is rejected with 400.28472848- `description: optional string or null`28492850 Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).28512852 maxLength: 200028532854- `match: optional BetaFederationRuleMatch or null`28552856 Does the incoming JWT qualify?28572858 All populated fields must pass; omitted fields are skipped. At least one2859 of `subject_prefix` (other than a wildcard-only value like `*`), `claims`,2860 or `condition` is required; `audience` alone is not sufficient.28612862 - `audience: optional string or null`28632864 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.28652866 maxLength: 102428672868 - `claims: optional map[string] or null`28692870 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.28712872 - `condition: optional string or null`28732874 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.28752876 maxLength: 409628772878 - `subject_prefix: optional string or null`28792880 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.28812882 maxLength: 102428832884- `name: optional string or null`28852886 Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.28872888 maxLength: 255, minLength: 128892890- `oauth_scope: optional string or null`28912892 Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.28932894 minLength: 128952896- `target: optional BetaServiceAccountTarget or null`28972898 Bind to a fixed service account by ID.28992900 - `type: "service_account"`29012902 - `service_account_id: string`29032904 Tagged ID of the service account to mint tokens for.29052906 - `service_account_name: optional string or null`29072908 Service account's display name at read time. Ignored on writes.29092910- `token_lifetime_seconds: optional number or null`29112912 Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.29132914 maximum: 86400, minimum: 6029152916- `workspace_id: optional string or null`29172918 Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead.29192920#### Returns29212922- `BetaFederationRule object`29232924 Authorization rule binding an external OIDC identity to Anthropic.29252926 Evaluates the match conditions and mints an OAuth access token for the2927 resolved target, scoped to a single workspace where the rule is enabled2928 (chosen by the caller at exchange time when the rule is enabled for more2929 than one). For rules enabled via `workspace_ids` or2930 `applies_to_all_workspaces`, the target service account must be a member2931 of that workspace (it is implicitly a member of the default workspace);2932 rules carrying only the legacy `workspace_id` binding do not enforce2933 this.29342935 - `type: "federation_rule"`29362937 default: federation_rule29382939 - `id: string`29402941 Tagged ID of the federation rule.29422943 - `applies_to_all_workspaces: boolean`29442945 When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.29462947 - `archived_at: string or null`29482949 If set, this rule is archived and rejects token exchange.29502951 format: date-time29522953 - `archived_by_actor_id: string or null`29542955 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.29562957 - `attributes: map[string] or null`29582959 CEL expressions extracting named values from claims. Not yet supported; always null.29602961 - `created_at: string`29622963 When this rule was created.29642965 format: date-time29662967 - `created_by_actor_id: string or null`29682969 Tagged ID (`user_`/`svac_`) of the actor that created this rule.29702971 - `description: string or null`29722973 Optional free-text description.29742975 - `issuer_id: string`29762977 Tagged ID of the issuer whose tokens this rule accepts.29782979 - `issuer_name: string or null`29802981 Issuer's display name at read time.29822983 - `match: BetaFederationRuleMatch`29842985 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.29862987 - `audience: optional string or null`29882989 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.29902991 maxLength: 102429922993 - `claims: optional map[string] or null`29942995 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.29962997 - `condition: optional string or null`29982999 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.30003001 maxLength: 409630023003 - `subject_prefix: optional string or null`30043005 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.30063007 maxLength: 102430083009 - `name: string`30103011 Admin-chosen slug identifier.30123013 - `oauth_scope: string`30143015 Space-separated OAuth scopes granted on the minted token.30163017 - `target: BetaServiceAccountTarget`30183019 Identity that tokens minted via this rule act as. Currently always a `service_account` target.30203021 - `type: "service_account"`30223023 - `service_account_id: string`30243025 Tagged ID of the service account to mint tokens for.30263027 - `service_account_name: optional string or null`30283029 Service account's display name at read time. Ignored on writes.30303031 - `token_lifetime_seconds: number`30323033 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.30343035 - `updated_at: string`30363037 When this rule was last updated.30383039 format: date-time30403041 - `updated_by_actor_id: string or null`30423043 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.30443045 - `workspace_id: string or null`30463047 Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.30483049 - `workspace_ids: array of string`30503051 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).30523053#### Example30543055```bash3056curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \3057 -H 'Content-Type: application/json' \3058 -H 'anthropic-version: 2023-06-01' \3059 -H "X-Api-Key: $ANTHROPIC_API_KEY" \3060 -d '{}'3061```30623063##### Response (200)30643065```json3066{3067 "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",3068 "applies_to_all_workspaces": true,3069 "archived_at": "2019-12-27T18:11:19.117Z",3070 "archived_by_actor_id": "archived_by_actor_id",3071 "attributes": {3072 "foo": "string"3073 },3074 "created_at": "2024-10-30T23:58:27.427722Z",3075 "created_by_actor_id": "created_by_actor_id",3076 "description": "description",3077 "issuer_id": "issuer_id",3078 "issuer_name": "issuer_name",3079 "match": {3080 "audience": "audience",3081 "claims": {3082 "foo": "string"3083 },3084 "condition": "condition",3085 "subject_prefix": "subject_prefix"3086 },3087 "name": "prod-deploy-pipeline",3088 "oauth_scope": "oauth_scope",3089 "target": {3090 "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",3091 "type": "service_account",3092 "service_account_name": "service_account_name"3093 },3094 "token_lifetime_seconds": 0,3095 "type": "federation_rule",3096 "updated_at": "2024-10-30T23:58:27.427722Z",3097 "updated_by_actor_id": "updated_by_actor_id",3098 "workspace_id": "workspace_id",3099 "workspace_ids": [3100 "string"3101 ]3102}3103```31043105### Archive Federation Rule31063107**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`31083109**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).31103111Archive a federation rule.31123113Token exchange through this rule stops immediately. Idempotent;3114re-archiving returns the rule with its original `archived_at`. Archiving3115clears the rule's workspace targeting (`workspace_id` and3116`workspace_ids` are emptied). Tokens already minted before archive3117remain valid until they expire. OAuth callers may only manage rules3118whose `oauth_scope` is `workspace:developer` or `workspace:inference`;3119other scopes require a Console session.31203121#### Path parameters31223123- `federation_rule_id: string`31243125 ID of the federation rule to archive.31263127#### Headers31283129- `"anthropic-beta": optional array of AnthropicBeta`31303131 Optional header to specify the beta version(s) you want to use.31323133 - `string`31343135 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`31363137 - `"message-batches-2024-09-24"`31383139 - `"prompt-caching-2024-07-31"`31403141 - `"computer-use-2024-10-22"`31423143 - `"computer-use-2025-01-24"`31443145 - `"pdfs-2024-09-25"`31463147 - `"token-counting-2024-11-01"`31483149 - `"token-efficient-tools-2025-02-19"`31503151 - `"output-128k-2025-02-19"`31523153 - `"files-api-2025-04-14"`31543155 - `"mcp-client-2025-04-04"`31563157 - `"mcp-client-2025-11-20"`31583159 - `"dev-full-thinking-2025-05-14"`31603161 - `"interleaved-thinking-2025-05-14"`31623163 - `"code-execution-2025-05-22"`31643165 - `"extended-cache-ttl-2025-04-11"`31663167 - `"context-1m-2025-08-07"`31683169 - `"context-management-2025-06-27"`31703171 - `"model-context-window-exceeded-2025-08-26"`31723173 - `"skills-2025-10-02"`31743175 - `"fast-mode-2026-02-01"`31763177 - `"output-300k-2026-03-24"`31783179 - `"user-profiles-2026-03-24"`31803181 - `"user-profiles-2026-08-18"`31823183 - `"user-profiles-2026-09-04"`31843185 - `"advisor-tool-2026-03-01"`31863187 - `"managed-agents-2026-04-01"`31883189 - `"cache-diagnosis-2026-04-07"`31903191 - `"dreaming-2026-04-21"`31923193 - `"thinking-token-count-2026-05-13"`31943195 - `"server-side-fallback-2026-06-01"`31963197 - `"server-side-fallback-2026-07-01"`31983199 - `"fallback-credit-2026-06-01"`32003201 - `"fallback-credit-2026-07-01"`32023203 - `"agent-memory-2026-07-22"`32043205 - `"mid-conversation-tool-changes-2026-07-01"`32063207 - `"compact-2026-01-12"`32083209 - `"computer-use-2025-11-24"`32103211 - `"mcp-tunnels-2026-06-22"`32123213 - `"structured-outputs-2025-11-13"`32143215 - `"task-budgets-2026-03-13"`32163217 - `"thinking-display-updates-2026-08-18"`32183219 - `"ce-user-management-2026-07-13"`32203221 - `"mid-conversation-output-config-2026-07-01"`32223223 - `"thinking-binding-controls-2026-08-01"`32243225 - `"mid-conversation-system-clear-at-2026-08-21"`32263227 - `"compact-2026-09-04"`32283229#### Returns32303231- `BetaFederationRule object`32323233 Authorization rule binding an external OIDC identity to Anthropic.32343235 Evaluates the match conditions and mints an OAuth access token for the3236 resolved target, scoped to a single workspace where the rule is enabled3237 (chosen by the caller at exchange time when the rule is enabled for more3238 than one). For rules enabled via `workspace_ids` or3239 `applies_to_all_workspaces`, the target service account must be a member3240 of that workspace (it is implicitly a member of the default workspace);3241 rules carrying only the legacy `workspace_id` binding do not enforce3242 this.32433244 - `type: "federation_rule"`32453246 default: federation_rule32473248 - `id: string`32493250 Tagged ID of the federation rule.32513252 - `applies_to_all_workspaces: boolean`32533254 When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.32553256 - `archived_at: string or null`32573258 If set, this rule is archived and rejects token exchange.32593260 format: date-time32613262 - `archived_by_actor_id: string or null`32633264 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.32653266 - `attributes: map[string] or null`32673268 CEL expressions extracting named values from claims. Not yet supported; always null.32693270 - `created_at: string`32713272 When this rule was created.32733274 format: date-time32753276 - `created_by_actor_id: string or null`32773278 Tagged ID (`user_`/`svac_`) of the actor that created this rule.32793280 - `description: string or null`32813282 Optional free-text description.32833284 - `issuer_id: string`32853286 Tagged ID of the issuer whose tokens this rule accepts.32873288 - `issuer_name: string or null`32893290 Issuer's display name at read time.32913292 - `match: BetaFederationRuleMatch`32933294 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.32953296 - `audience: optional string or null`32973298 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.32993300 maxLength: 102433013302 - `claims: optional map[string] or null`33033304 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.33053306 - `condition: optional string or null`33073308 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.33093310 maxLength: 409633113312 - `subject_prefix: optional string or null`33133314 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.33153316 maxLength: 102433173318 - `name: string`33193320 Admin-chosen slug identifier.33213322 - `oauth_scope: string`33233324 Space-separated OAuth scopes granted on the minted token.33253326 - `target: BetaServiceAccountTarget`33273328 Identity that tokens minted via this rule act as. Currently always a `service_account` target.33293330 - `type: "service_account"`33313332 - `service_account_id: string`33333334 Tagged ID of the service account to mint tokens for.33353336 - `service_account_name: optional string or null`33373338 Service account's display name at read time. Ignored on writes.33393340 - `token_lifetime_seconds: number`33413342 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.33433344 - `updated_at: string`33453346 When this rule was last updated.33473348 format: date-time33493350 - `updated_by_actor_id: string or null`33513352 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.33533354 - `workspace_id: string or null`33553356 Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.33573358 - `workspace_ids: array of string`33593360 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).33613362#### Example33633364```bash3365curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \3366 -X POST \3367 -H 'anthropic-version: 2023-06-01' \3368 -H "X-Api-Key: $ANTHROPIC_API_KEY"3369```33703371##### Response (200)33723373```json3374{3375 "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",3376 "applies_to_all_workspaces": true,3377 "archived_at": "2019-12-27T18:11:19.117Z",3378 "archived_by_actor_id": "archived_by_actor_id",3379 "attributes": {3380 "foo": "string"3381 },3382 "created_at": "2024-10-30T23:58:27.427722Z",3383 "created_by_actor_id": "created_by_actor_id",3384 "description": "description",3385 "issuer_id": "issuer_id",3386 "issuer_name": "issuer_name",3387 "match": {3388 "audience": "audience",3389 "claims": {3390 "foo": "string"3391 },3392 "condition": "condition",3393 "subject_prefix": "subject_prefix"3394 },3395 "name": "prod-deploy-pipeline",3396 "oauth_scope": "oauth_scope",3397 "target": {3398 "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",3399 "type": "service_account",3400 "service_account_name": "service_account_name"3401 },3402 "token_lifetime_seconds": 0,3403 "type": "federation_rule",3404 "updated_at": "2024-10-30T23:58:27.427722Z",3405 "updated_by_actor_id": "updated_by_actor_id",3406 "workspace_id": "workspace_id",3407 "workspace_ids": [3408 "string"3409 ]3410}3411```34123413## Federation › Rules › Workspaces34143415### Add Federation Rule Workspace34163417**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`34183419**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).34203421Enable a federation rule for a workspace.34223423Idempotent; re-enabling returns the existing enablement. The rule and3424workspace must both belong to your organization. Membership of the3425rule's target service account in this workspace is not checked at3426enablement: token exchange into this workspace is rejected unless the3427target is a member (it is implicitly a member of the default workspace).3428Archived rules are rejected with 400. OAuth callers may only manage rules3429whose `oauth_scope` is `workspace:developer` or `workspace:inference`;3430other scopes require a Console session.34313432#### Path parameters34333434- `federation_rule_id: string`34353436 ID of the federation rule.34373438#### Headers34393440- `"anthropic-beta": optional array of AnthropicBeta`34413442 Optional header to specify the beta version(s) you want to use.34433444 - `string`34453446 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`34473448 - `"message-batches-2024-09-24"`34493450 - `"prompt-caching-2024-07-31"`34513452 - `"computer-use-2024-10-22"`34533454 - `"computer-use-2025-01-24"`34553456 - `"pdfs-2024-09-25"`34573458 - `"token-counting-2024-11-01"`34593460 - `"token-efficient-tools-2025-02-19"`34613462 - `"output-128k-2025-02-19"`34633464 - `"files-api-2025-04-14"`34653466 - `"mcp-client-2025-04-04"`34673468 - `"mcp-client-2025-11-20"`34693470 - `"dev-full-thinking-2025-05-14"`34713472 - `"interleaved-thinking-2025-05-14"`34733474 - `"code-execution-2025-05-22"`34753476 - `"extended-cache-ttl-2025-04-11"`34773478 - `"context-1m-2025-08-07"`34793480 - `"context-management-2025-06-27"`34813482 - `"model-context-window-exceeded-2025-08-26"`34833484 - `"skills-2025-10-02"`34853486 - `"fast-mode-2026-02-01"`34873488 - `"output-300k-2026-03-24"`34893490 - `"user-profiles-2026-03-24"`34913492 - `"user-profiles-2026-08-18"`34933494 - `"user-profiles-2026-09-04"`34953496 - `"advisor-tool-2026-03-01"`34973498 - `"managed-agents-2026-04-01"`34993500 - `"cache-diagnosis-2026-04-07"`35013502 - `"dreaming-2026-04-21"`35033504 - `"thinking-token-count-2026-05-13"`35053506 - `"server-side-fallback-2026-06-01"`35073508 - `"server-side-fallback-2026-07-01"`35093510 - `"fallback-credit-2026-06-01"`35113512 - `"fallback-credit-2026-07-01"`35133514 - `"agent-memory-2026-07-22"`35153516 - `"mid-conversation-tool-changes-2026-07-01"`35173518 - `"compact-2026-01-12"`35193520 - `"computer-use-2025-11-24"`35213522 - `"mcp-tunnels-2026-06-22"`35233524 - `"structured-outputs-2025-11-13"`35253526 - `"task-budgets-2026-03-13"`35273528 - `"thinking-display-updates-2026-08-18"`35293530 - `"ce-user-management-2026-07-13"`35313532 - `"mid-conversation-output-config-2026-07-01"`35333534 - `"thinking-binding-controls-2026-08-01"`35353536 - `"mid-conversation-system-clear-at-2026-08-21"`35373538 - `"compact-2026-09-04"`35393540#### Body parameters35413542- `workspace_id: string`35433544 Tagged ID of the workspace to enable this rule for.35453546#### Returns35473548- `BetaFederationRuleWorkspace object`35493550 - `type: "federation_rule_workspace"`35513552 default: federation_rule_workspace35533554 - `created_at: string`35553556 When this workspace was enabled for the rule.35573558 format: date-time35593560 - `created_by_actor_id: string or null`35613562 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.35633564 - `federation_rule_id: string`35653566 Tagged ID of the federation rule.35673568 - `workspace_id: string`35693570 Tagged ID of the workspace this rule is enabled for.35713572 - `workspace_name: string or null`35733574 Workspace display name. Populated when listing; null in the enable response.35753576#### Example35773578```bash3579curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \3580 -H 'Content-Type: application/json' \3581 -H 'anthropic-version: 2023-06-01' \3582 -H "X-Api-Key: $ANTHROPIC_API_KEY" \3583 -d '{3584 "workspace_id": "workspace_id"3585 }'3586```35873588##### Response (200)35893590```json3591{3592 "created_at": "2024-10-30T23:58:27.427722Z",3593 "created_by_actor_id": "created_by_actor_id",3594 "federation_rule_id": "federation_rule_id",3595 "type": "federation_rule_workspace",3596 "workspace_id": "workspace_id",3597 "workspace_name": "workspace_name"3598}3599```36003601### List Federation Rule Workspaces36023603**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`36043605**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).36063607List workspaces where this federation rule is enabled.36083609Returns all workspace enablements in a single response; the `limit` and3610`page` parameters are accepted but have no effect, and `next_page` is3611always `null`. Returns explicit per-workspace enablements only; for3612rules with `applies_to_all_workspaces` or a legacy single3613`workspace_id`, check those fields on the rule itself.36143615#### Path parameters36163617- `federation_rule_id: string`36183619 ID of the federation rule.36203621#### Query parameters36223623- `limit: optional number`36243625 Number of results per page.36263627 default: 20, maximum: 100, minimum: 136283629- `page: optional string`36303631 Opaque cursor from a previous response's `next_page`.36323633#### Headers36343635- `"anthropic-beta": optional array of AnthropicBeta`36363637 Optional header to specify the beta version(s) you want to use.36383639 - `string`36403641 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`36423643 - `"message-batches-2024-09-24"`36443645 - `"prompt-caching-2024-07-31"`36463647 - `"computer-use-2024-10-22"`36483649 - `"computer-use-2025-01-24"`36503651 - `"pdfs-2024-09-25"`36523653 - `"token-counting-2024-11-01"`36543655 - `"token-efficient-tools-2025-02-19"`36563657 - `"output-128k-2025-02-19"`36583659 - `"files-api-2025-04-14"`36603661 - `"mcp-client-2025-04-04"`36623663 - `"mcp-client-2025-11-20"`36643665 - `"dev-full-thinking-2025-05-14"`36663667 - `"interleaved-thinking-2025-05-14"`36683669 - `"code-execution-2025-05-22"`36703671 - `"extended-cache-ttl-2025-04-11"`36723673 - `"context-1m-2025-08-07"`36743675 - `"context-management-2025-06-27"`36763677 - `"model-context-window-exceeded-2025-08-26"`36783679 - `"skills-2025-10-02"`36803681 - `"fast-mode-2026-02-01"`36823683 - `"output-300k-2026-03-24"`36843685 - `"user-profiles-2026-03-24"`36863687 - `"user-profiles-2026-08-18"`36883689 - `"user-profiles-2026-09-04"`36903691 - `"advisor-tool-2026-03-01"`36923693 - `"managed-agents-2026-04-01"`36943695 - `"cache-diagnosis-2026-04-07"`36963697 - `"dreaming-2026-04-21"`36983699 - `"thinking-token-count-2026-05-13"`37003701 - `"server-side-fallback-2026-06-01"`37023703 - `"server-side-fallback-2026-07-01"`37043705 - `"fallback-credit-2026-06-01"`37063707 - `"fallback-credit-2026-07-01"`37083709 - `"agent-memory-2026-07-22"`37103711 - `"mid-conversation-tool-changes-2026-07-01"`37123713 - `"compact-2026-01-12"`37143715 - `"computer-use-2025-11-24"`37163717 - `"mcp-tunnels-2026-06-22"`37183719 - `"structured-outputs-2025-11-13"`37203721 - `"task-budgets-2026-03-13"`37223723 - `"thinking-display-updates-2026-08-18"`37243725 - `"ce-user-management-2026-07-13"`37263727 - `"mid-conversation-output-config-2026-07-01"`37283729 - `"thinking-binding-controls-2026-08-01"`37303731 - `"mid-conversation-system-clear-at-2026-08-21"`37323733 - `"compact-2026-09-04"`37343735#### Returns37363737- `data: array of BetaFederationRuleWorkspace`37383739 - `type: "federation_rule_workspace"`37403741 default: federation_rule_workspace37423743 - `created_at: string`37443745 When this workspace was enabled for the rule.37463747 format: date-time37483749 - `created_by_actor_id: string or null`37503751 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.37523753 - `federation_rule_id: string`37543755 Tagged ID of the federation rule.37563757 - `workspace_id: string`37583759 Tagged ID of the workspace this rule is enabled for.37603761 - `workspace_name: string or null`37623763 Workspace display name. Populated when listing; null in the enable response.37643765- `next_page: string or null`37663767 Opaque cursor for the next page; null when there are no more results.37683769#### Example37703771```bash3772curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \3773 -H 'anthropic-version: 2023-06-01' \3774 -H "X-Api-Key: $ANTHROPIC_API_KEY"3775```37763777##### Response (200)37783779```json3780{3781 "data": [3782 {3783 "created_at": "2024-10-30T23:58:27.427722Z",3784 "created_by_actor_id": "created_by_actor_id",3785 "federation_rule_id": "federation_rule_id",3786 "type": "federation_rule_workspace",3787 "workspace_id": "workspace_id",3788 "workspace_name": "workspace_name"3789 }3790 ],3791 "next_page": "next_page"3792}3793```37943795### Remove Federation Rule Workspace37963797**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`37983799**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).38003801Disable a federation rule for a workspace.38023803Idempotent; succeeds even if the enablement was already removed. OAuth3804callers may only manage rules whose `oauth_scope` is3805`workspace:developer` or `workspace:inference`; other scopes require a3806Console session.38073808#### Path parameters38093810- `federation_rule_id: string`38113812 ID of the federation rule.38133814- `workspace_id: string`38153816 ID of the workspace to disable for.38173818#### Headers38193820- `"anthropic-beta": optional array of AnthropicBeta`38213822 Optional header to specify the beta version(s) you want to use.38233824 - `string`38253826 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`38273828 - `"message-batches-2024-09-24"`38293830 - `"prompt-caching-2024-07-31"`38313832 - `"computer-use-2024-10-22"`38333834 - `"computer-use-2025-01-24"`38353836 - `"pdfs-2024-09-25"`38373838 - `"token-counting-2024-11-01"`38393840 - `"token-efficient-tools-2025-02-19"`38413842 - `"output-128k-2025-02-19"`38433844 - `"files-api-2025-04-14"`38453846 - `"mcp-client-2025-04-04"`38473848 - `"mcp-client-2025-11-20"`38493850 - `"dev-full-thinking-2025-05-14"`38513852 - `"interleaved-thinking-2025-05-14"`38533854 - `"code-execution-2025-05-22"`38553856 - `"extended-cache-ttl-2025-04-11"`38573858 - `"context-1m-2025-08-07"`38593860 - `"context-management-2025-06-27"`38613862 - `"model-context-window-exceeded-2025-08-26"`38633864 - `"skills-2025-10-02"`38653866 - `"fast-mode-2026-02-01"`38673868 - `"output-300k-2026-03-24"`38693870 - `"user-profiles-2026-03-24"`38713872 - `"user-profiles-2026-08-18"`38733874 - `"user-profiles-2026-09-04"`38753876 - `"advisor-tool-2026-03-01"`38773878 - `"managed-agents-2026-04-01"`38793880 - `"cache-diagnosis-2026-04-07"`38813882 - `"dreaming-2026-04-21"`38833884 - `"thinking-token-count-2026-05-13"`38853886 - `"server-side-fallback-2026-06-01"`38873888 - `"server-side-fallback-2026-07-01"`38893890 - `"fallback-credit-2026-06-01"`38913892 - `"fallback-credit-2026-07-01"`38933894 - `"agent-memory-2026-07-22"`38953896 - `"mid-conversation-tool-changes-2026-07-01"`38973898 - `"compact-2026-01-12"`38993900 - `"computer-use-2025-11-24"`39013902 - `"mcp-tunnels-2026-06-22"`39033904 - `"structured-outputs-2025-11-13"`39053906 - `"task-budgets-2026-03-13"`39073908 - `"thinking-display-updates-2026-08-18"`39093910 - `"ce-user-management-2026-07-13"`39113912 - `"mid-conversation-output-config-2026-07-01"`39133914 - `"thinking-binding-controls-2026-08-01"`39153916 - `"mid-conversation-system-clear-at-2026-08-21"`39173918 - `"compact-2026-09-04"`39193920#### Returns39213922- `type: "federation_rule_workspace_deleted"`39233924 default: federation_rule_workspace_deleted39253926- `federation_rule_id: string`39273928 Tagged ID of the federation rule.39293930- `workspace_id: string`39313932 Tagged ID of the workspace named in the delete request. Removal is idempotent.39333934#### Example39353936```bash3937curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \3938 -X DELETE \3939 -H 'anthropic-version: 2023-06-01' \3940 -H "X-Api-Key: $ANTHROPIC_API_KEY"3941```39423943##### Response (200)39443945```json3946{3947 "federation_rule_id": "federation_rule_id",3948 "type": "federation_rule_workspace_deleted",3949 "workspace_id": "workspace_id"3950}3951```3952