Repository Public
1---2title: Rules3url: https://platform.claude.com/docs/en/api/beta/organization/federation/rules4---56# Rules78## Create Federation Rule910**POST** `/v1/organizations/federation_rules`1112**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).1314Create a federation rule owned by your organization.1516The referenced issuer and the target service account must already exist17in the same organization; invalid references are rejected with a 40018error. The workspace reference is validated. Membership is not checked19at rule creation: token exchange resolves a single enabled workspace per20call and is rejected unless the target service account is a member of21that workspace (it is implicitly a member of the default workspace).22Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite,23Terraform Cloud, Google) must constrain tenant identity via an24identity-bearing claim, a tenant-pinning subject prefix (such as25`repo:YOUR_ORG/...`), or a CEL condition referencing one of those26identity claims (e.g. `claims.repository_owner`). OAuth callers may only27manage rules whose `oauth_scope` is `workspace:developer` or28`workspace:inference`; other scopes require a Console session.2930### Headers3132- `"anthropic-beta": optional array of AnthropicBeta`3334 Optional header to specify the beta version(s) you want to use.3536 - `string`3738 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`3940 - `"message-batches-2024-09-24"`4142 - `"prompt-caching-2024-07-31"`4344 - `"computer-use-2024-10-22"`4546 - `"computer-use-2025-01-24"`4748 - `"pdfs-2024-09-25"`4950 - `"token-counting-2024-11-01"`5152 - `"token-efficient-tools-2025-02-19"`5354 - `"output-128k-2025-02-19"`5556 - `"files-api-2025-04-14"`5758 - `"mcp-client-2025-04-04"`5960 - `"mcp-client-2025-11-20"`6162 - `"dev-full-thinking-2025-05-14"`6364 - `"interleaved-thinking-2025-05-14"`6566 - `"code-execution-2025-05-22"`6768 - `"extended-cache-ttl-2025-04-11"`6970 - `"context-1m-2025-08-07"`7172 - `"context-management-2025-06-27"`7374 - `"model-context-window-exceeded-2025-08-26"`7576 - `"skills-2025-10-02"`7778 - `"fast-mode-2026-02-01"`7980 - `"output-300k-2026-03-24"`8182 - `"user-profiles-2026-03-24"`8384 - `"user-profiles-2026-08-18"`8586 - `"user-profiles-2026-09-04"`8788 - `"advisor-tool-2026-03-01"`8990 - `"managed-agents-2026-04-01"`9192 - `"cache-diagnosis-2026-04-07"`9394 - `"dreaming-2026-04-21"`9596 - `"thinking-token-count-2026-05-13"`9798 - `"server-side-fallback-2026-06-01"`99100 - `"server-side-fallback-2026-07-01"`101102 - `"fallback-credit-2026-06-01"`103104 - `"fallback-credit-2026-07-01"`105106 - `"agent-memory-2026-07-22"`107108 - `"mid-conversation-tool-changes-2026-07-01"`109110 - `"compact-2026-01-12"`111112 - `"computer-use-2025-11-24"`113114 - `"mcp-tunnels-2026-06-22"`115116 - `"structured-outputs-2025-11-13"`117118 - `"task-budgets-2026-03-13"`119120 - `"thinking-display-updates-2026-08-18"`121122 - `"ce-user-management-2026-07-13"`123124 - `"mid-conversation-output-config-2026-07-01"`125126 - `"thinking-binding-controls-2026-08-01"`127128 - `"mid-conversation-system-clear-at-2026-08-21"`129130 - `"compact-2026-09-04"`131132### Body parameters133134- `issuer_id: string`135136 Tagged ID of the federation issuer.137138- `match: BetaFederationRuleMatch`139140 Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.141142 - `audience: optional string or null`143144 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.145146 maxLength: 1024147148 - `claims: optional map[string] or null`149150 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.151152 - `condition: optional string or null`153154 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.155156 maxLength: 4096157158 - `subject_prefix: optional string or null`159160 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.161162 maxLength: 1024163164- `name: string`165166 Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.167168 maxLength: 255, minLength: 1169170- `oauth_scope: string`171172 Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.173174 minLength: 1175176- `target: BetaServiceAccountTarget`177178 Identity that tokens minted via this rule act as. Currently always a `service_account` target.179180 - `type: "service_account"`181182 - `service_account_id: string`183184 Tagged ID of the service account to mint tokens for.185186 - `service_account_name: optional string or null`187188 Service account's display name at read time. Ignored on writes.189190- `applies_to_all_workspaces: optional boolean`191192 When true, enable this rule for every workspace in the org (including workspaces created later).193194- `attributes: optional map[string] or null`195196 CEL expressions `{name: expr}` extracting named values from claims. Not yet supported; any non-empty value is rejected with 400.197198- `description: optional string or null`199200 Optional free-text description.201202 maxLength: 2000203204- `token_lifetime_seconds: optional number`205206 Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.207208 maximum: 86400, minimum: 60209210- `workspace_id: optional string or null`211212 Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.213214### Returns215216- `BetaFederationRule object`217218 Authorization rule binding an external OIDC identity to Anthropic.219220 Evaluates the match conditions and mints an OAuth access token for the221 resolved target, scoped to a single workspace where the rule is enabled222 (chosen by the caller at exchange time when the rule is enabled for more223 than one). For rules enabled via `workspace_ids` or224 `applies_to_all_workspaces`, the target service account must be a member225 of that workspace (it is implicitly a member of the default workspace);226 rules carrying only the legacy `workspace_id` binding do not enforce227 this.228229 - `type: "federation_rule"`230231 default: federation_rule232233 - `id: string`234235 Tagged ID of the federation rule.236237 - `applies_to_all_workspaces: boolean`238239 When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.240241 - `archived_at: string or null`242243 If set, this rule is archived and rejects token exchange.244245 format: date-time246247 - `archived_by_actor_id: string or null`248249 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.250251 - `attributes: map[string] or null`252253 CEL expressions extracting named values from claims. Not yet supported; always null.254255 - `created_at: string`256257 When this rule was created.258259 format: date-time260261 - `created_by_actor_id: string or null`262263 Tagged ID (`user_`/`svac_`) of the actor that created this rule.264265 - `description: string or null`266267 Optional free-text description.268269 - `issuer_id: string`270271 Tagged ID of the issuer whose tokens this rule accepts.272273 - `issuer_name: string or null`274275 Issuer's display name at read time.276277 - `match: BetaFederationRuleMatch`278279 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.280281 - `audience: optional string or null`282283 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.284285 maxLength: 1024286287 - `claims: optional map[string] or null`288289 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.290291 - `condition: optional string or null`292293 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.294295 maxLength: 4096296297 - `subject_prefix: optional string or null`298299 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.300301 maxLength: 1024302303 - `name: string`304305 Admin-chosen slug identifier.306307 - `oauth_scope: string`308309 Space-separated OAuth scopes granted on the minted token.310311 - `target: BetaServiceAccountTarget`312313 Identity that tokens minted via this rule act as. Currently always a `service_account` target.314315 - `type: "service_account"`316317 - `service_account_id: string`318319 Tagged ID of the service account to mint tokens for.320321 - `service_account_name: optional string or null`322323 Service account's display name at read time. Ignored on writes.324325 - `token_lifetime_seconds: number`326327 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.328329 - `updated_at: string`330331 When this rule was last updated.332333 format: date-time334335 - `updated_by_actor_id: string or null`336337 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.338339 - `workspace_id: string or null`340341 Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.342343 - `workspace_ids: array of string`344345 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).346347### Example348349```bash350curl https://api.anthropic.com/v1/organizations/federation_rules \351 -H 'Content-Type: application/json' \352 -H 'anthropic-version: 2023-06-01' \353 -H "X-Api-Key: $ANTHROPIC_API_KEY" \354 -d '{355 "issuer_id": "issuer_id",356 "match": {},357 "name": "x",358 "oauth_scope": "x",359 "target": {360 "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",361 "type": "service_account"362 }363 }'364```365366#### Response (200)367368```json369{370 "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",371 "applies_to_all_workspaces": true,372 "archived_at": "2019-12-27T18:11:19.117Z",373 "archived_by_actor_id": "archived_by_actor_id",374 "attributes": {375 "foo": "string"376 },377 "created_at": "2024-10-30T23:58:27.427722Z",378 "created_by_actor_id": "created_by_actor_id",379 "description": "description",380 "issuer_id": "issuer_id",381 "issuer_name": "issuer_name",382 "match": {383 "audience": "audience",384 "claims": {385 "foo": "string"386 },387 "condition": "condition",388 "subject_prefix": "subject_prefix"389 },390 "name": "prod-deploy-pipeline",391 "oauth_scope": "oauth_scope",392 "target": {393 "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",394 "type": "service_account",395 "service_account_name": "service_account_name"396 },397 "token_lifetime_seconds": 0,398 "type": "federation_rule",399 "updated_at": "2024-10-30T23:58:27.427722Z",400 "updated_by_actor_id": "updated_by_actor_id",401 "workspace_id": "workspace_id",402 "workspace_ids": [403 "string"404 ]405}406```407408## List Federation Rules409410**GET** `/v1/organizations/federation_rules`411412**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).413414List federation rules in your organization.415416Optionally filter by issuer with `issuer_id`. Archived rules are excluded417unless `include_archived=true`.418419### Query parameters420421- `include_archived: optional boolean`422423 Include archived resources. Defaults to false.424425 default: false426427- `issuer_id: optional string`428429 Filter to rules referencing this federation issuer.430431- `limit: optional number`432433 Number of results per page.434435 default: 20, maximum: 100, minimum: 1436437- `page: optional string`438439 Opaque cursor from a previous response's `next_page`.440441### Headers442443- `"anthropic-beta": optional array of AnthropicBeta`444445 Optional header to specify the beta version(s) you want to use.446447 - `string`448449 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`450451 - `"message-batches-2024-09-24"`452453 - `"prompt-caching-2024-07-31"`454455 - `"computer-use-2024-10-22"`456457 - `"computer-use-2025-01-24"`458459 - `"pdfs-2024-09-25"`460461 - `"token-counting-2024-11-01"`462463 - `"token-efficient-tools-2025-02-19"`464465 - `"output-128k-2025-02-19"`466467 - `"files-api-2025-04-14"`468469 - `"mcp-client-2025-04-04"`470471 - `"mcp-client-2025-11-20"`472473 - `"dev-full-thinking-2025-05-14"`474475 - `"interleaved-thinking-2025-05-14"`476477 - `"code-execution-2025-05-22"`478479 - `"extended-cache-ttl-2025-04-11"`480481 - `"context-1m-2025-08-07"`482483 - `"context-management-2025-06-27"`484485 - `"model-context-window-exceeded-2025-08-26"`486487 - `"skills-2025-10-02"`488489 - `"fast-mode-2026-02-01"`490491 - `"output-300k-2026-03-24"`492493 - `"user-profiles-2026-03-24"`494495 - `"user-profiles-2026-08-18"`496497 - `"user-profiles-2026-09-04"`498499 - `"advisor-tool-2026-03-01"`500501 - `"managed-agents-2026-04-01"`502503 - `"cache-diagnosis-2026-04-07"`504505 - `"dreaming-2026-04-21"`506507 - `"thinking-token-count-2026-05-13"`508509 - `"server-side-fallback-2026-06-01"`510511 - `"server-side-fallback-2026-07-01"`512513 - `"fallback-credit-2026-06-01"`514515 - `"fallback-credit-2026-07-01"`516517 - `"agent-memory-2026-07-22"`518519 - `"mid-conversation-tool-changes-2026-07-01"`520521 - `"compact-2026-01-12"`522523 - `"computer-use-2025-11-24"`524525 - `"mcp-tunnels-2026-06-22"`526527 - `"structured-outputs-2025-11-13"`528529 - `"task-budgets-2026-03-13"`530531 - `"thinking-display-updates-2026-08-18"`532533 - `"ce-user-management-2026-07-13"`534535 - `"mid-conversation-output-config-2026-07-01"`536537 - `"thinking-binding-controls-2026-08-01"`538539 - `"mid-conversation-system-clear-at-2026-08-21"`540541 - `"compact-2026-09-04"`542543### Returns544545- `data: array of BetaFederationRule`546547 - `type: "federation_rule"`548549 default: federation_rule550551 - `id: string`552553 Tagged ID of the federation rule.554555 - `applies_to_all_workspaces: boolean`556557 When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.558559 - `archived_at: string or null`560561 If set, this rule is archived and rejects token exchange.562563 format: date-time564565 - `archived_by_actor_id: string or null`566567 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.568569 - `attributes: map[string] or null`570571 CEL expressions extracting named values from claims. Not yet supported; always null.572573 - `created_at: string`574575 When this rule was created.576577 format: date-time578579 - `created_by_actor_id: string or null`580581 Tagged ID (`user_`/`svac_`) of the actor that created this rule.582583 - `description: string or null`584585 Optional free-text description.586587 - `issuer_id: string`588589 Tagged ID of the issuer whose tokens this rule accepts.590591 - `issuer_name: string or null`592593 Issuer's display name at read time.594595 - `match: BetaFederationRuleMatch`596597 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.598599 - `audience: optional string or null`600601 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.602603 maxLength: 1024604605 - `claims: optional map[string] or null`606607 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.608609 - `condition: optional string or null`610611 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.612613 maxLength: 4096614615 - `subject_prefix: optional string or null`616617 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.618619 maxLength: 1024620621 - `name: string`622623 Admin-chosen slug identifier.624625 - `oauth_scope: string`626627 Space-separated OAuth scopes granted on the minted token.628629 - `target: BetaServiceAccountTarget`630631 Identity that tokens minted via this rule act as. Currently always a `service_account` target.632633 - `type: "service_account"`634635 - `service_account_id: string`636637 Tagged ID of the service account to mint tokens for.638639 - `service_account_name: optional string or null`640641 Service account's display name at read time. Ignored on writes.642643 - `token_lifetime_seconds: number`644645 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.646647 - `updated_at: string`648649 When this rule was last updated.650651 format: date-time652653 - `updated_by_actor_id: string or null`654655 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.656657 - `workspace_id: string or null`658659 Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.660661 - `workspace_ids: array of string`662663 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).664665- `next_page: string or null`666667 Opaque cursor for the next page, or null if no more results.668669### Example670671```bash672curl https://api.anthropic.com/v1/organizations/federation_rules \673 -H 'anthropic-version: 2023-06-01' \674 -H "X-Api-Key: $ANTHROPIC_API_KEY"675```676677#### Response (200)678679```json680{681 "data": [682 {683 "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",684 "applies_to_all_workspaces": true,685 "archived_at": "2019-12-27T18:11:19.117Z",686 "archived_by_actor_id": "archived_by_actor_id",687 "attributes": {688 "foo": "string"689 },690 "created_at": "2024-10-30T23:58:27.427722Z",691 "created_by_actor_id": "created_by_actor_id",692 "description": "description",693 "issuer_id": "issuer_id",694 "issuer_name": "issuer_name",695 "match": {696 "audience": "audience",697 "claims": {698 "foo": "string"699 },700 "condition": "condition",701 "subject_prefix": "subject_prefix"702 },703 "name": "prod-deploy-pipeline",704 "oauth_scope": "oauth_scope",705 "target": {706 "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",707 "type": "service_account",708 "service_account_name": "service_account_name"709 },710 "token_lifetime_seconds": 0,711 "type": "federation_rule",712 "updated_at": "2024-10-30T23:58:27.427722Z",713 "updated_by_actor_id": "updated_by_actor_id",714 "workspace_id": "workspace_id",715 "workspace_ids": [716 "string"717 ]718 }719 ],720 "next_page": "next_page"721}722```723724## Get Federation Rule725726**GET** `/v1/organizations/federation_rules/{federation_rule_id}`727728**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).729730Retrieve a federation rule by its ID (`fdrl_...`).731732### Path parameters733734- `federation_rule_id: string`735736 ID of the federation rule.737738### Headers739740- `"anthropic-beta": optional array of AnthropicBeta`741742 Optional header to specify the beta version(s) you want to use.743744 - `string`745746 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`747748 - `"message-batches-2024-09-24"`749750 - `"prompt-caching-2024-07-31"`751752 - `"computer-use-2024-10-22"`753754 - `"computer-use-2025-01-24"`755756 - `"pdfs-2024-09-25"`757758 - `"token-counting-2024-11-01"`759760 - `"token-efficient-tools-2025-02-19"`761762 - `"output-128k-2025-02-19"`763764 - `"files-api-2025-04-14"`765766 - `"mcp-client-2025-04-04"`767768 - `"mcp-client-2025-11-20"`769770 - `"dev-full-thinking-2025-05-14"`771772 - `"interleaved-thinking-2025-05-14"`773774 - `"code-execution-2025-05-22"`775776 - `"extended-cache-ttl-2025-04-11"`777778 - `"context-1m-2025-08-07"`779780 - `"context-management-2025-06-27"`781782 - `"model-context-window-exceeded-2025-08-26"`783784 - `"skills-2025-10-02"`785786 - `"fast-mode-2026-02-01"`787788 - `"output-300k-2026-03-24"`789790 - `"user-profiles-2026-03-24"`791792 - `"user-profiles-2026-08-18"`793794 - `"user-profiles-2026-09-04"`795796 - `"advisor-tool-2026-03-01"`797798 - `"managed-agents-2026-04-01"`799800 - `"cache-diagnosis-2026-04-07"`801802 - `"dreaming-2026-04-21"`803804 - `"thinking-token-count-2026-05-13"`805806 - `"server-side-fallback-2026-06-01"`807808 - `"server-side-fallback-2026-07-01"`809810 - `"fallback-credit-2026-06-01"`811812 - `"fallback-credit-2026-07-01"`813814 - `"agent-memory-2026-07-22"`815816 - `"mid-conversation-tool-changes-2026-07-01"`817818 - `"compact-2026-01-12"`819820 - `"computer-use-2025-11-24"`821822 - `"mcp-tunnels-2026-06-22"`823824 - `"structured-outputs-2025-11-13"`825826 - `"task-budgets-2026-03-13"`827828 - `"thinking-display-updates-2026-08-18"`829830 - `"ce-user-management-2026-07-13"`831832 - `"mid-conversation-output-config-2026-07-01"`833834 - `"thinking-binding-controls-2026-08-01"`835836 - `"mid-conversation-system-clear-at-2026-08-21"`837838 - `"compact-2026-09-04"`839840### Returns841842- `BetaFederationRule object`843844 Authorization rule binding an external OIDC identity to Anthropic.845846 Evaluates the match conditions and mints an OAuth access token for the847 resolved target, scoped to a single workspace where the rule is enabled848 (chosen by the caller at exchange time when the rule is enabled for more849 than one). For rules enabled via `workspace_ids` or850 `applies_to_all_workspaces`, the target service account must be a member851 of that workspace (it is implicitly a member of the default workspace);852 rules carrying only the legacy `workspace_id` binding do not enforce853 this.854855 - `type: "federation_rule"`856857 default: federation_rule858859 - `id: string`860861 Tagged ID of the federation rule.862863 - `applies_to_all_workspaces: boolean`864865 When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.866867 - `archived_at: string or null`868869 If set, this rule is archived and rejects token exchange.870871 format: date-time872873 - `archived_by_actor_id: string or null`874875 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.876877 - `attributes: map[string] or null`878879 CEL expressions extracting named values from claims. Not yet supported; always null.880881 - `created_at: string`882883 When this rule was created.884885 format: date-time886887 - `created_by_actor_id: string or null`888889 Tagged ID (`user_`/`svac_`) of the actor that created this rule.890891 - `description: string or null`892893 Optional free-text description.894895 - `issuer_id: string`896897 Tagged ID of the issuer whose tokens this rule accepts.898899 - `issuer_name: string or null`900901 Issuer's display name at read time.902903 - `match: BetaFederationRuleMatch`904905 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.906907 - `audience: optional string or null`908909 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.910911 maxLength: 1024912913 - `claims: optional map[string] or null`914915 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.916917 - `condition: optional string or null`918919 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.920921 maxLength: 4096922923 - `subject_prefix: optional string or null`924925 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.926927 maxLength: 1024928929 - `name: string`930931 Admin-chosen slug identifier.932933 - `oauth_scope: string`934935 Space-separated OAuth scopes granted on the minted token.936937 - `target: BetaServiceAccountTarget`938939 Identity that tokens minted via this rule act as. Currently always a `service_account` target.940941 - `type: "service_account"`942943 - `service_account_id: string`944945 Tagged ID of the service account to mint tokens for.946947 - `service_account_name: optional string or null`948949 Service account's display name at read time. Ignored on writes.950951 - `token_lifetime_seconds: number`952953 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.954955 - `updated_at: string`956957 When this rule was last updated.958959 format: date-time960961 - `updated_by_actor_id: string or null`962963 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.964965 - `workspace_id: string or null`966967 Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.968969 - `workspace_ids: array of string`970971 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).972973### Example974975```bash976curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \977 -H 'anthropic-version: 2023-06-01' \978 -H "X-Api-Key: $ANTHROPIC_API_KEY"979```980981#### Response (200)982983```json984{985 "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",986 "applies_to_all_workspaces": true,987 "archived_at": "2019-12-27T18:11:19.117Z",988 "archived_by_actor_id": "archived_by_actor_id",989 "attributes": {990 "foo": "string"991 },992 "created_at": "2024-10-30T23:58:27.427722Z",993 "created_by_actor_id": "created_by_actor_id",994 "description": "description",995 "issuer_id": "issuer_id",996 "issuer_name": "issuer_name",997 "match": {998 "audience": "audience",999 "claims": {1000 "foo": "string"1001 },1002 "condition": "condition",1003 "subject_prefix": "subject_prefix"1004 },1005 "name": "prod-deploy-pipeline",1006 "oauth_scope": "oauth_scope",1007 "target": {1008 "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",1009 "type": "service_account",1010 "service_account_name": "service_account_name"1011 },1012 "token_lifetime_seconds": 0,1013 "type": "federation_rule",1014 "updated_at": "2024-10-30T23:58:27.427722Z",1015 "updated_by_actor_id": "updated_by_actor_id",1016 "workspace_id": "workspace_id",1017 "workspace_ids": [1018 "string"1019 ]1020}1021```10221023## Update Federation Rule10241025**POST** `/v1/organizations/federation_rules/{federation_rule_id}`10261027**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).10281029Partially update a federation rule.10301031`issuer_id` is immutable. `match` and `target` are replaced as whole1032objects when set. Referenced service accounts and workspaces must exist1033in your organization; invalid references are rejected with a 400 error.1034Archived rules cannot be updated; this returns 400. Create a new rule1035instead. Rules on well-known shared issuers (GitHub Actions, GitLab,1036Buildkite, Terraform Cloud, Google) must constrain tenant identity via1037an identity-bearing claim, a tenant-pinning subject prefix (such as1038`repo:YOUR_ORG/...`), or a CEL condition referencing one of those1039identity claims (e.g. `claims.repository_owner`). On these issuers the1040requirement is re-checked on every update; if an existing rule's stored1041match does not yet constrain tenant identity, any update (even a rename1042or description change) must also supply a conforming `match` in the same1043request. OAuth callers may only manage rules whose `oauth_scope` is1044`workspace:developer` or `workspace:inference`; other scopes require a1045Console session.10461047### Path parameters10481049- `federation_rule_id: string`10501051 ID of the federation rule to update.10521053### Headers10541055- `"anthropic-beta": optional array of AnthropicBeta`10561057 Optional header to specify the beta version(s) you want to use.10581059 - `string`10601061 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`10621063 - `"message-batches-2024-09-24"`10641065 - `"prompt-caching-2024-07-31"`10661067 - `"computer-use-2024-10-22"`10681069 - `"computer-use-2025-01-24"`10701071 - `"pdfs-2024-09-25"`10721073 - `"token-counting-2024-11-01"`10741075 - `"token-efficient-tools-2025-02-19"`10761077 - `"output-128k-2025-02-19"`10781079 - `"files-api-2025-04-14"`10801081 - `"mcp-client-2025-04-04"`10821083 - `"mcp-client-2025-11-20"`10841085 - `"dev-full-thinking-2025-05-14"`10861087 - `"interleaved-thinking-2025-05-14"`10881089 - `"code-execution-2025-05-22"`10901091 - `"extended-cache-ttl-2025-04-11"`10921093 - `"context-1m-2025-08-07"`10941095 - `"context-management-2025-06-27"`10961097 - `"model-context-window-exceeded-2025-08-26"`10981099 - `"skills-2025-10-02"`11001101 - `"fast-mode-2026-02-01"`11021103 - `"output-300k-2026-03-24"`11041105 - `"user-profiles-2026-03-24"`11061107 - `"user-profiles-2026-08-18"`11081109 - `"user-profiles-2026-09-04"`11101111 - `"advisor-tool-2026-03-01"`11121113 - `"managed-agents-2026-04-01"`11141115 - `"cache-diagnosis-2026-04-07"`11161117 - `"dreaming-2026-04-21"`11181119 - `"thinking-token-count-2026-05-13"`11201121 - `"server-side-fallback-2026-06-01"`11221123 - `"server-side-fallback-2026-07-01"`11241125 - `"fallback-credit-2026-06-01"`11261127 - `"fallback-credit-2026-07-01"`11281129 - `"agent-memory-2026-07-22"`11301131 - `"mid-conversation-tool-changes-2026-07-01"`11321133 - `"compact-2026-01-12"`11341135 - `"computer-use-2025-11-24"`11361137 - `"mcp-tunnels-2026-06-22"`11381139 - `"structured-outputs-2025-11-13"`11401141 - `"task-budgets-2026-03-13"`11421143 - `"thinking-display-updates-2026-08-18"`11441145 - `"ce-user-management-2026-07-13"`11461147 - `"mid-conversation-output-config-2026-07-01"`11481149 - `"thinking-binding-controls-2026-08-01"`11501151 - `"mid-conversation-system-clear-at-2026-08-21"`11521153 - `"compact-2026-09-04"`11541155### Body parameters11561157- `applies_to_all_workspaces: optional boolean or null`11581159 When true, enables this rule for every workspace in the org (including workspaces created later). Setting `false` is rejected with 400 if no workspace would remain enabled; a rule with only a legacy `workspace_id` binding continues to mint.11601161- `attributes: optional map[string] or null`11621163 Replaces the CEL expressions `{name: expr}` extracting named values from claims. Send null to clear them. Not yet supported; any non-empty value is rejected with 400.11641165- `description: optional string or null`11661167 Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).11681169 maxLength: 200011701171- `match: optional BetaFederationRuleMatch or null`11721173 Does the incoming JWT qualify?11741175 All populated fields must pass; omitted fields are skipped. At least one1176 of `subject_prefix` (other than a wildcard-only value like `*`), `claims`,1177 or `condition` is required; `audience` alone is not sufficient.11781179 - `audience: optional string or null`11801181 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.11821183 maxLength: 102411841185 - `claims: optional map[string] or null`11861187 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.11881189 - `condition: optional string or null`11901191 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.11921193 maxLength: 409611941195 - `subject_prefix: optional string or null`11961197 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.11981199 maxLength: 102412001201- `name: optional string or null`12021203 Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.12041205 maxLength: 255, minLength: 112061207- `oauth_scope: optional string or null`12081209 Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.12101211 minLength: 112121213- `target: optional BetaServiceAccountTarget or null`12141215 Bind to a fixed service account by ID.12161217 - `type: "service_account"`12181219 - `service_account_id: string`12201221 Tagged ID of the service account to mint tokens for.12221223 - `service_account_name: optional string or null`12241225 Service account's display name at read time. Ignored on writes.12261227- `token_lifetime_seconds: optional number or null`12281229 Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.12301231 maximum: 86400, minimum: 6012321233- `workspace_id: optional string or null`12341235 Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead.12361237### Returns12381239- `BetaFederationRule object`12401241 Authorization rule binding an external OIDC identity to Anthropic.12421243 Evaluates the match conditions and mints an OAuth access token for the1244 resolved target, scoped to a single workspace where the rule is enabled1245 (chosen by the caller at exchange time when the rule is enabled for more1246 than one). For rules enabled via `workspace_ids` or1247 `applies_to_all_workspaces`, the target service account must be a member1248 of that workspace (it is implicitly a member of the default workspace);1249 rules carrying only the legacy `workspace_id` binding do not enforce1250 this.12511252 - `type: "federation_rule"`12531254 default: federation_rule12551256 - `id: string`12571258 Tagged ID of the federation rule.12591260 - `applies_to_all_workspaces: boolean`12611262 When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.12631264 - `archived_at: string or null`12651266 If set, this rule is archived and rejects token exchange.12671268 format: date-time12691270 - `archived_by_actor_id: string or null`12711272 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.12731274 - `attributes: map[string] or null`12751276 CEL expressions extracting named values from claims. Not yet supported; always null.12771278 - `created_at: string`12791280 When this rule was created.12811282 format: date-time12831284 - `created_by_actor_id: string or null`12851286 Tagged ID (`user_`/`svac_`) of the actor that created this rule.12871288 - `description: string or null`12891290 Optional free-text description.12911292 - `issuer_id: string`12931294 Tagged ID of the issuer whose tokens this rule accepts.12951296 - `issuer_name: string or null`12971298 Issuer's display name at read time.12991300 - `match: BetaFederationRuleMatch`13011302 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.13031304 - `audience: optional string or null`13051306 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.13071308 maxLength: 102413091310 - `claims: optional map[string] or null`13111312 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.13131314 - `condition: optional string or null`13151316 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.13171318 maxLength: 409613191320 - `subject_prefix: optional string or null`13211322 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.13231324 maxLength: 102413251326 - `name: string`13271328 Admin-chosen slug identifier.13291330 - `oauth_scope: string`13311332 Space-separated OAuth scopes granted on the minted token.13331334 - `target: BetaServiceAccountTarget`13351336 Identity that tokens minted via this rule act as. Currently always a `service_account` target.13371338 - `type: "service_account"`13391340 - `service_account_id: string`13411342 Tagged ID of the service account to mint tokens for.13431344 - `service_account_name: optional string or null`13451346 Service account's display name at read time. Ignored on writes.13471348 - `token_lifetime_seconds: number`13491350 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.13511352 - `updated_at: string`13531354 When this rule was last updated.13551356 format: date-time13571358 - `updated_by_actor_id: string or null`13591360 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.13611362 - `workspace_id: string or null`13631364 Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.13651366 - `workspace_ids: array of string`13671368 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).13691370### Example13711372```bash1373curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \1374 -H 'Content-Type: application/json' \1375 -H 'anthropic-version: 2023-06-01' \1376 -H "X-Api-Key: $ANTHROPIC_API_KEY" \1377 -d '{}'1378```13791380#### Response (200)13811382```json1383{1384 "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",1385 "applies_to_all_workspaces": true,1386 "archived_at": "2019-12-27T18:11:19.117Z",1387 "archived_by_actor_id": "archived_by_actor_id",1388 "attributes": {1389 "foo": "string"1390 },1391 "created_at": "2024-10-30T23:58:27.427722Z",1392 "created_by_actor_id": "created_by_actor_id",1393 "description": "description",1394 "issuer_id": "issuer_id",1395 "issuer_name": "issuer_name",1396 "match": {1397 "audience": "audience",1398 "claims": {1399 "foo": "string"1400 },1401 "condition": "condition",1402 "subject_prefix": "subject_prefix"1403 },1404 "name": "prod-deploy-pipeline",1405 "oauth_scope": "oauth_scope",1406 "target": {1407 "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",1408 "type": "service_account",1409 "service_account_name": "service_account_name"1410 },1411 "token_lifetime_seconds": 0,1412 "type": "federation_rule",1413 "updated_at": "2024-10-30T23:58:27.427722Z",1414 "updated_by_actor_id": "updated_by_actor_id",1415 "workspace_id": "workspace_id",1416 "workspace_ids": [1417 "string"1418 ]1419}1420```14211422## Archive Federation Rule14231424**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`14251426**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).14271428Archive a federation rule.14291430Token exchange through this rule stops immediately. Idempotent;1431re-archiving returns the rule with its original `archived_at`. Archiving1432clears the rule's workspace targeting (`workspace_id` and1433`workspace_ids` are emptied). Tokens already minted before archive1434remain valid until they expire. OAuth callers may only manage rules1435whose `oauth_scope` is `workspace:developer` or `workspace:inference`;1436other scopes require a Console session.14371438### Path parameters14391440- `federation_rule_id: string`14411442 ID of the federation rule to archive.14431444### Headers14451446- `"anthropic-beta": optional array of AnthropicBeta`14471448 Optional header to specify the beta version(s) you want to use.14491450 - `string`14511452 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`14531454 - `"message-batches-2024-09-24"`14551456 - `"prompt-caching-2024-07-31"`14571458 - `"computer-use-2024-10-22"`14591460 - `"computer-use-2025-01-24"`14611462 - `"pdfs-2024-09-25"`14631464 - `"token-counting-2024-11-01"`14651466 - `"token-efficient-tools-2025-02-19"`14671468 - `"output-128k-2025-02-19"`14691470 - `"files-api-2025-04-14"`14711472 - `"mcp-client-2025-04-04"`14731474 - `"mcp-client-2025-11-20"`14751476 - `"dev-full-thinking-2025-05-14"`14771478 - `"interleaved-thinking-2025-05-14"`14791480 - `"code-execution-2025-05-22"`14811482 - `"extended-cache-ttl-2025-04-11"`14831484 - `"context-1m-2025-08-07"`14851486 - `"context-management-2025-06-27"`14871488 - `"model-context-window-exceeded-2025-08-26"`14891490 - `"skills-2025-10-02"`14911492 - `"fast-mode-2026-02-01"`14931494 - `"output-300k-2026-03-24"`14951496 - `"user-profiles-2026-03-24"`14971498 - `"user-profiles-2026-08-18"`14991500 - `"user-profiles-2026-09-04"`15011502 - `"advisor-tool-2026-03-01"`15031504 - `"managed-agents-2026-04-01"`15051506 - `"cache-diagnosis-2026-04-07"`15071508 - `"dreaming-2026-04-21"`15091510 - `"thinking-token-count-2026-05-13"`15111512 - `"server-side-fallback-2026-06-01"`15131514 - `"server-side-fallback-2026-07-01"`15151516 - `"fallback-credit-2026-06-01"`15171518 - `"fallback-credit-2026-07-01"`15191520 - `"agent-memory-2026-07-22"`15211522 - `"mid-conversation-tool-changes-2026-07-01"`15231524 - `"compact-2026-01-12"`15251526 - `"computer-use-2025-11-24"`15271528 - `"mcp-tunnels-2026-06-22"`15291530 - `"structured-outputs-2025-11-13"`15311532 - `"task-budgets-2026-03-13"`15331534 - `"thinking-display-updates-2026-08-18"`15351536 - `"ce-user-management-2026-07-13"`15371538 - `"mid-conversation-output-config-2026-07-01"`15391540 - `"thinking-binding-controls-2026-08-01"`15411542 - `"mid-conversation-system-clear-at-2026-08-21"`15431544 - `"compact-2026-09-04"`15451546### Returns15471548- `BetaFederationRule object`15491550 Authorization rule binding an external OIDC identity to Anthropic.15511552 Evaluates the match conditions and mints an OAuth access token for the1553 resolved target, scoped to a single workspace where the rule is enabled1554 (chosen by the caller at exchange time when the rule is enabled for more1555 than one). For rules enabled via `workspace_ids` or1556 `applies_to_all_workspaces`, the target service account must be a member1557 of that workspace (it is implicitly a member of the default workspace);1558 rules carrying only the legacy `workspace_id` binding do not enforce1559 this.15601561 - `type: "federation_rule"`15621563 default: federation_rule15641565 - `id: string`15661567 Tagged ID of the federation rule.15681569 - `applies_to_all_workspaces: boolean`15701571 When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.15721573 - `archived_at: string or null`15741575 If set, this rule is archived and rejects token exchange.15761577 format: date-time15781579 - `archived_by_actor_id: string or null`15801581 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.15821583 - `attributes: map[string] or null`15841585 CEL expressions extracting named values from claims. Not yet supported; always null.15861587 - `created_at: string`15881589 When this rule was created.15901591 format: date-time15921593 - `created_by_actor_id: string or null`15941595 Tagged ID (`user_`/`svac_`) of the actor that created this rule.15961597 - `description: string or null`15981599 Optional free-text description.16001601 - `issuer_id: string`16021603 Tagged ID of the issuer whose tokens this rule accepts.16041605 - `issuer_name: string or null`16061607 Issuer's display name at read time.16081609 - `match: BetaFederationRuleMatch`16101611 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.16121613 - `audience: optional string or null`16141615 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.16161617 maxLength: 102416181619 - `claims: optional map[string] or null`16201621 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.16221623 - `condition: optional string or null`16241625 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.16261627 maxLength: 409616281629 - `subject_prefix: optional string or null`16301631 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.16321633 maxLength: 102416341635 - `name: string`16361637 Admin-chosen slug identifier.16381639 - `oauth_scope: string`16401641 Space-separated OAuth scopes granted on the minted token.16421643 - `target: BetaServiceAccountTarget`16441645 Identity that tokens minted via this rule act as. Currently always a `service_account` target.16461647 - `type: "service_account"`16481649 - `service_account_id: string`16501651 Tagged ID of the service account to mint tokens for.16521653 - `service_account_name: optional string or null`16541655 Service account's display name at read time. Ignored on writes.16561657 - `token_lifetime_seconds: number`16581659 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.16601661 - `updated_at: string`16621663 When this rule was last updated.16641665 format: date-time16661667 - `updated_by_actor_id: string or null`16681669 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.16701671 - `workspace_id: string or null`16721673 Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.16741675 - `workspace_ids: array of string`16761677 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).16781679### Example16801681```bash1682curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/archive \1683 -X POST \1684 -H 'anthropic-version: 2023-06-01' \1685 -H "X-Api-Key: $ANTHROPIC_API_KEY"1686```16871688#### Response (200)16891690```json1691{1692 "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",1693 "applies_to_all_workspaces": true,1694 "archived_at": "2019-12-27T18:11:19.117Z",1695 "archived_by_actor_id": "archived_by_actor_id",1696 "attributes": {1697 "foo": "string"1698 },1699 "created_at": "2024-10-30T23:58:27.427722Z",1700 "created_by_actor_id": "created_by_actor_id",1701 "description": "description",1702 "issuer_id": "issuer_id",1703 "issuer_name": "issuer_name",1704 "match": {1705 "audience": "audience",1706 "claims": {1707 "foo": "string"1708 },1709 "condition": "condition",1710 "subject_prefix": "subject_prefix"1711 },1712 "name": "prod-deploy-pipeline",1713 "oauth_scope": "oauth_scope",1714 "target": {1715 "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",1716 "type": "service_account",1717 "service_account_name": "service_account_name"1718 },1719 "token_lifetime_seconds": 0,1720 "type": "federation_rule",1721 "updated_at": "2024-10-30T23:58:27.427722Z",1722 "updated_by_actor_id": "updated_by_actor_id",1723 "workspace_id": "workspace_id",1724 "workspace_ids": [1725 "string"1726 ]1727}1728```17291730## Domain types17311732### Beta Federation Rule17331734- `BetaFederationRule object`17351736 Authorization rule binding an external OIDC identity to Anthropic.17371738 Evaluates the match conditions and mints an OAuth access token for the1739 resolved target, scoped to a single workspace where the rule is enabled1740 (chosen by the caller at exchange time when the rule is enabled for more1741 than one). For rules enabled via `workspace_ids` or1742 `applies_to_all_workspaces`, the target service account must be a member1743 of that workspace (it is implicitly a member of the default workspace);1744 rules carrying only the legacy `workspace_id` binding do not enforce1745 this.17461747 - `type: "federation_rule"`17481749 default: federation_rule17501751 - `id: string`17521753 Tagged ID of the federation rule.17541755 - `applies_to_all_workspaces: boolean`17561757 When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.17581759 - `archived_at: string or null`17601761 If set, this rule is archived and rejects token exchange.17621763 format: date-time17641765 - `archived_by_actor_id: string or null`17661767 Tagged ID (`user_`/`svac_`) of the actor that archived this rule.17681769 - `attributes: map[string] or null`17701771 CEL expressions extracting named values from claims. Not yet supported; always null.17721773 - `created_at: string`17741775 When this rule was created.17761777 format: date-time17781779 - `created_by_actor_id: string or null`17801781 Tagged ID (`user_`/`svac_`) of the actor that created this rule.17821783 - `description: string or null`17841785 Optional free-text description.17861787 - `issuer_id: string`17881789 Tagged ID of the issuer whose tokens this rule accepts.17901791 - `issuer_name: string or null`17921793 Issuer's display name at read time.17941795 - `match: BetaFederationRuleMatch`17961797 Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.17981799 - `audience: optional string or null`18001801 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.18021803 maxLength: 102418041805 - `claims: optional map[string] or null`18061807 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.18081809 - `condition: optional string or null`18101811 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.18121813 maxLength: 409618141815 - `subject_prefix: optional string or null`18161817 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.18181819 maxLength: 102418201821 - `name: string`18221823 Admin-chosen slug identifier.18241825 - `oauth_scope: string`18261827 Space-separated OAuth scopes granted on the minted token.18281829 - `target: BetaServiceAccountTarget`18301831 Identity that tokens minted via this rule act as. Currently always a `service_account` target.18321833 - `type: "service_account"`18341835 - `service_account_id: string`18361837 Tagged ID of the service account to mint tokens for.18381839 - `service_account_name: optional string or null`18401841 Service account's display name at read time. Ignored on writes.18421843 - `token_lifetime_seconds: number`18441845 Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.18461847 - `updated_at: string`18481849 When this rule was last updated.18501851 format: date-time18521853 - `updated_by_actor_id: string or null`18541855 Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.18561857 - `workspace_id: string or null`18581859 Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement.18601861 - `workspace_ids: array of string`18621863 Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).18641865### Beta Federation Rule Match18661867- `BetaFederationRuleMatch object`18681869 Does the incoming JWT qualify?18701871 All populated fields must pass; omitted fields are skipped. At least one1872 of `subject_prefix` (other than a wildcard-only value like `*`), `claims`,1873 or `condition` is required; `audience` alone is not sufficient.18741875 - `audience: optional string or null`18761877 Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.18781879 maxLength: 102418801881 - `claims: optional map[string] or null`18821883 Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims.18841885 - `condition: optional string or null`18861887 CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400.18881889 maxLength: 409618901891 - `subject_prefix: optional string or null`18921893 Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`.18941895 maxLength: 102418961897### Beta Federation Rule Workspace18981899- `BetaFederationRuleWorkspace object`19001901 - `type: "federation_rule_workspace"`19021903 default: federation_rule_workspace19041905 - `created_at: string`19061907 When this workspace was enabled for the rule.19081909 format: date-time19101911 - `created_by_actor_id: string or null`19121913 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.19141915 - `federation_rule_id: string`19161917 Tagged ID of the federation rule.19181919 - `workspace_id: string`19201921 Tagged ID of the workspace this rule is enabled for.19221923 - `workspace_name: string or null`19241925 Workspace display name. Populated when listing; null in the enable response.19261927### Beta Service Account Target19281929- `BetaServiceAccountTarget object`19301931 Bind to a fixed service account by ID.19321933 - `type: "service_account"`19341935 - `service_account_id: string`19361937 Tagged ID of the service account to mint tokens for.19381939 - `service_account_name: optional string or null`19401941 Service account's display name at read time. Ignored on writes.19421943## Rules › Workspaces19441945### Add Federation Rule Workspace19461947**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`19481949**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).19501951Enable a federation rule for a workspace.19521953Idempotent; re-enabling returns the existing enablement. The rule and1954workspace must both belong to your organization. Membership of the1955rule's target service account in this workspace is not checked at1956enablement: token exchange into this workspace is rejected unless the1957target is a member (it is implicitly a member of the default workspace).1958Archived rules are rejected with 400. OAuth callers may only manage rules1959whose `oauth_scope` is `workspace:developer` or `workspace:inference`;1960other scopes require a Console session.19611962#### Path parameters19631964- `federation_rule_id: string`19651966 ID of the federation rule.19671968#### Headers19691970- `"anthropic-beta": optional array of AnthropicBeta`19711972 Optional header to specify the beta version(s) you want to use.19731974 - `string`19751976 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`19771978 - `"message-batches-2024-09-24"`19791980 - `"prompt-caching-2024-07-31"`19811982 - `"computer-use-2024-10-22"`19831984 - `"computer-use-2025-01-24"`19851986 - `"pdfs-2024-09-25"`19871988 - `"token-counting-2024-11-01"`19891990 - `"token-efficient-tools-2025-02-19"`19911992 - `"output-128k-2025-02-19"`19931994 - `"files-api-2025-04-14"`19951996 - `"mcp-client-2025-04-04"`19971998 - `"mcp-client-2025-11-20"`19992000 - `"dev-full-thinking-2025-05-14"`20012002 - `"interleaved-thinking-2025-05-14"`20032004 - `"code-execution-2025-05-22"`20052006 - `"extended-cache-ttl-2025-04-11"`20072008 - `"context-1m-2025-08-07"`20092010 - `"context-management-2025-06-27"`20112012 - `"model-context-window-exceeded-2025-08-26"`20132014 - `"skills-2025-10-02"`20152016 - `"fast-mode-2026-02-01"`20172018 - `"output-300k-2026-03-24"`20192020 - `"user-profiles-2026-03-24"`20212022 - `"user-profiles-2026-08-18"`20232024 - `"user-profiles-2026-09-04"`20252026 - `"advisor-tool-2026-03-01"`20272028 - `"managed-agents-2026-04-01"`20292030 - `"cache-diagnosis-2026-04-07"`20312032 - `"dreaming-2026-04-21"`20332034 - `"thinking-token-count-2026-05-13"`20352036 - `"server-side-fallback-2026-06-01"`20372038 - `"server-side-fallback-2026-07-01"`20392040 - `"fallback-credit-2026-06-01"`20412042 - `"fallback-credit-2026-07-01"`20432044 - `"agent-memory-2026-07-22"`20452046 - `"mid-conversation-tool-changes-2026-07-01"`20472048 - `"compact-2026-01-12"`20492050 - `"computer-use-2025-11-24"`20512052 - `"mcp-tunnels-2026-06-22"`20532054 - `"structured-outputs-2025-11-13"`20552056 - `"task-budgets-2026-03-13"`20572058 - `"thinking-display-updates-2026-08-18"`20592060 - `"ce-user-management-2026-07-13"`20612062 - `"mid-conversation-output-config-2026-07-01"`20632064 - `"thinking-binding-controls-2026-08-01"`20652066 - `"mid-conversation-system-clear-at-2026-08-21"`20672068 - `"compact-2026-09-04"`20692070#### Body parameters20712072- `workspace_id: string`20732074 Tagged ID of the workspace to enable this rule for.20752076#### Returns20772078- `BetaFederationRuleWorkspace object`20792080 - `type: "federation_rule_workspace"`20812082 default: federation_rule_workspace20832084 - `created_at: string`20852086 When this workspace was enabled for the rule.20872088 format: date-time20892090 - `created_by_actor_id: string or null`20912092 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.20932094 - `federation_rule_id: string`20952096 Tagged ID of the federation rule.20972098 - `workspace_id: string`20992100 Tagged ID of the workspace this rule is enabled for.21012102 - `workspace_name: string or null`21032104 Workspace display name. Populated when listing; null in the enable response.21052106#### Example21072108```bash2109curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \2110 -H 'Content-Type: application/json' \2111 -H 'anthropic-version: 2023-06-01' \2112 -H "X-Api-Key: $ANTHROPIC_API_KEY" \2113 -d '{2114 "workspace_id": "workspace_id"2115 }'2116```21172118##### Response (200)21192120```json2121{2122 "created_at": "2024-10-30T23:58:27.427722Z",2123 "created_by_actor_id": "created_by_actor_id",2124 "federation_rule_id": "federation_rule_id",2125 "type": "federation_rule_workspace",2126 "workspace_id": "workspace_id",2127 "workspace_name": "workspace_name"2128}2129```21302131### List Federation Rule Workspaces21322133**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`21342135**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).21362137List workspaces where this federation rule is enabled.21382139Returns all workspace enablements in a single response; the `limit` and2140`page` parameters are accepted but have no effect, and `next_page` is2141always `null`. Returns explicit per-workspace enablements only; for2142rules with `applies_to_all_workspaces` or a legacy single2143`workspace_id`, check those fields on the rule itself.21442145#### Path parameters21462147- `federation_rule_id: string`21482149 ID of the federation rule.21502151#### Query parameters21522153- `limit: optional number`21542155 Number of results per page.21562157 default: 20, maximum: 100, minimum: 121582159- `page: optional string`21602161 Opaque cursor from a previous response's `next_page`.21622163#### Headers21642165- `"anthropic-beta": optional array of AnthropicBeta`21662167 Optional header to specify the beta version(s) you want to use.21682169 - `string`21702171 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`21722173 - `"message-batches-2024-09-24"`21742175 - `"prompt-caching-2024-07-31"`21762177 - `"computer-use-2024-10-22"`21782179 - `"computer-use-2025-01-24"`21802181 - `"pdfs-2024-09-25"`21822183 - `"token-counting-2024-11-01"`21842185 - `"token-efficient-tools-2025-02-19"`21862187 - `"output-128k-2025-02-19"`21882189 - `"files-api-2025-04-14"`21902191 - `"mcp-client-2025-04-04"`21922193 - `"mcp-client-2025-11-20"`21942195 - `"dev-full-thinking-2025-05-14"`21962197 - `"interleaved-thinking-2025-05-14"`21982199 - `"code-execution-2025-05-22"`22002201 - `"extended-cache-ttl-2025-04-11"`22022203 - `"context-1m-2025-08-07"`22042205 - `"context-management-2025-06-27"`22062207 - `"model-context-window-exceeded-2025-08-26"`22082209 - `"skills-2025-10-02"`22102211 - `"fast-mode-2026-02-01"`22122213 - `"output-300k-2026-03-24"`22142215 - `"user-profiles-2026-03-24"`22162217 - `"user-profiles-2026-08-18"`22182219 - `"user-profiles-2026-09-04"`22202221 - `"advisor-tool-2026-03-01"`22222223 - `"managed-agents-2026-04-01"`22242225 - `"cache-diagnosis-2026-04-07"`22262227 - `"dreaming-2026-04-21"`22282229 - `"thinking-token-count-2026-05-13"`22302231 - `"server-side-fallback-2026-06-01"`22322233 - `"server-side-fallback-2026-07-01"`22342235 - `"fallback-credit-2026-06-01"`22362237 - `"fallback-credit-2026-07-01"`22382239 - `"agent-memory-2026-07-22"`22402241 - `"mid-conversation-tool-changes-2026-07-01"`22422243 - `"compact-2026-01-12"`22442245 - `"computer-use-2025-11-24"`22462247 - `"mcp-tunnels-2026-06-22"`22482249 - `"structured-outputs-2025-11-13"`22502251 - `"task-budgets-2026-03-13"`22522253 - `"thinking-display-updates-2026-08-18"`22542255 - `"ce-user-management-2026-07-13"`22562257 - `"mid-conversation-output-config-2026-07-01"`22582259 - `"thinking-binding-controls-2026-08-01"`22602261 - `"mid-conversation-system-clear-at-2026-08-21"`22622263 - `"compact-2026-09-04"`22642265#### Returns22662267- `data: array of BetaFederationRuleWorkspace`22682269 - `type: "federation_rule_workspace"`22702271 default: federation_rule_workspace22722273 - `created_at: string`22742275 When this workspace was enabled for the rule.22762277 format: date-time22782279 - `created_by_actor_id: string or null`22802281 Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.22822283 - `federation_rule_id: string`22842285 Tagged ID of the federation rule.22862287 - `workspace_id: string`22882289 Tagged ID of the workspace this rule is enabled for.22902291 - `workspace_name: string or null`22922293 Workspace display name. Populated when listing; null in the enable response.22942295- `next_page: string or null`22962297 Opaque cursor for the next page; null when there are no more results.22982299#### Example23002301```bash2302curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces \2303 -H 'anthropic-version: 2023-06-01' \2304 -H "X-Api-Key: $ANTHROPIC_API_KEY"2305```23062307##### Response (200)23082309```json2310{2311 "data": [2312 {2313 "created_at": "2024-10-30T23:58:27.427722Z",2314 "created_by_actor_id": "created_by_actor_id",2315 "federation_rule_id": "federation_rule_id",2316 "type": "federation_rule_workspace",2317 "workspace_id": "workspace_id",2318 "workspace_name": "workspace_name"2319 }2320 ],2321 "next_page": "next_page"2322}2323```23242325### Remove Federation Rule Workspace23262327**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`23282329**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).23302331Disable a federation rule for a workspace.23322333Idempotent; succeeds even if the enablement was already removed. OAuth2334callers may only manage rules whose `oauth_scope` is2335`workspace:developer` or `workspace:inference`; other scopes require a2336Console session.23372338#### Path parameters23392340- `federation_rule_id: string`23412342 ID of the federation rule.23432344- `workspace_id: string`23452346 ID of the workspace to disable for.23472348#### Headers23492350- `"anthropic-beta": optional array of AnthropicBeta`23512352 Optional header to specify the beta version(s) you want to use.23532354 - `string`23552356 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`23572358 - `"message-batches-2024-09-24"`23592360 - `"prompt-caching-2024-07-31"`23612362 - `"computer-use-2024-10-22"`23632364 - `"computer-use-2025-01-24"`23652366 - `"pdfs-2024-09-25"`23672368 - `"token-counting-2024-11-01"`23692370 - `"token-efficient-tools-2025-02-19"`23712372 - `"output-128k-2025-02-19"`23732374 - `"files-api-2025-04-14"`23752376 - `"mcp-client-2025-04-04"`23772378 - `"mcp-client-2025-11-20"`23792380 - `"dev-full-thinking-2025-05-14"`23812382 - `"interleaved-thinking-2025-05-14"`23832384 - `"code-execution-2025-05-22"`23852386 - `"extended-cache-ttl-2025-04-11"`23872388 - `"context-1m-2025-08-07"`23892390 - `"context-management-2025-06-27"`23912392 - `"model-context-window-exceeded-2025-08-26"`23932394 - `"skills-2025-10-02"`23952396 - `"fast-mode-2026-02-01"`23972398 - `"output-300k-2026-03-24"`23992400 - `"user-profiles-2026-03-24"`24012402 - `"user-profiles-2026-08-18"`24032404 - `"user-profiles-2026-09-04"`24052406 - `"advisor-tool-2026-03-01"`24072408 - `"managed-agents-2026-04-01"`24092410 - `"cache-diagnosis-2026-04-07"`24112412 - `"dreaming-2026-04-21"`24132414 - `"thinking-token-count-2026-05-13"`24152416 - `"server-side-fallback-2026-06-01"`24172418 - `"server-side-fallback-2026-07-01"`24192420 - `"fallback-credit-2026-06-01"`24212422 - `"fallback-credit-2026-07-01"`24232424 - `"agent-memory-2026-07-22"`24252426 - `"mid-conversation-tool-changes-2026-07-01"`24272428 - `"compact-2026-01-12"`24292430 - `"computer-use-2025-11-24"`24312432 - `"mcp-tunnels-2026-06-22"`24332434 - `"structured-outputs-2025-11-13"`24352436 - `"task-budgets-2026-03-13"`24372438 - `"thinking-display-updates-2026-08-18"`24392440 - `"ce-user-management-2026-07-13"`24412442 - `"mid-conversation-output-config-2026-07-01"`24432444 - `"thinking-binding-controls-2026-08-01"`24452446 - `"mid-conversation-system-clear-at-2026-08-21"`24472448 - `"compact-2026-09-04"`24492450#### Returns24512452- `type: "federation_rule_workspace_deleted"`24532454 default: federation_rule_workspace_deleted24552456- `federation_rule_id: string`24572458 Tagged ID of the federation rule.24592460- `workspace_id: string`24612462 Tagged ID of the workspace named in the delete request. Removal is idempotent.24632464#### Example24652466```bash2467curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID/workspaces/$WORKSPACE_ID \2468 -X DELETE \2469 -H 'anthropic-version: 2023-06-01' \2470 -H "X-Api-Key: $ANTHROPIC_API_KEY"2471```24722473##### Response (200)24742475```json2476{2477 "federation_rule_id": "federation_rule_id",2478 "type": "federation_rule_workspace_deleted",2479 "workspace_id": "workspace_id"2480}2481```2482