#!/usr/bin/env python3
"""Admin API read-only probes with the official Python SDK (client.beta.organization.*).

STATUS: organization.retrieve() (GET /v1/organizations/me) → LIVE_VERIFIED 2026-09-18 with the REGULAR key (200).
        usage_report / cost_report / claude_code → ACCOUNT_RESTRICTED with a regular key
        (401 "The Admin API requires an Admin API key or an organization-scoped API key."); they run for real only when
        ANTHROPIC_ADMIN_KEY is set in .env (the SDK also honours ANTHROPIC_AUTH_TOKEN for org:admin OAuth tokens).
Run: .venv/bin/python examples/anthropic/admin/org_me_and_usage_report.py
"""
from __future__ import annotations
import os, sys
from datetime import datetime, timedelta, timezone
from pathlib import Path

ROOT = Path(__file__).resolve().parents[3]
sys.path.insert(0, str(ROOT))
from scripts.live import load_env, log_request, anthropic_request  # noqa: E402

load_env()
import anthropic  # noqa: E402

# 1. org info — any key kind
client = anthropic.Anthropic()
org = client.beta.organization.retrieve()
log_request("anthropic", "GET", "/v1/organizations/me", 200, 0, "sdk admin org me")
print("organization:", org.id, org.name)

# 2. Admin endpoints — use the admin key if present; otherwise show the 401 honestly via the raw helper
admin_key = os.environ.get("ANTHROPIC_ADMIN_KEY")
start = (datetime.now(timezone.utc) - timedelta(days=7)).strftime("%Y-%m-%dT00:00:00Z")
day = (datetime.now(timezone.utc) - timedelta(days=1)).strftime("%Y-%m-%d")

# NOTE: the Python SDK surface (sources/anthropic/openapi/python-sdk-api.md) exposes client.beta.organization.retrieve()
# but no usage_report / cost_report methods yet, so the reports use the raw helper (admin=True → ANTHROPIC_ADMIN_KEY).
paths = (f"/v1/organizations/usage_report/messages?starting_at={start}&bucket_width=1d&group_by[]=model&group_by[]=service_tier",
         f"/v1/organizations/cost_report?starting_at={start}&group_by[]=workspace_id",
         f"/v1/organizations/usage_report/claude_code?starting_at={day}&limit=5")
for path in paths:
    st, body, _ = anthropic_request("GET", path, admin=bool(admin_key), note="admin example report" + (" (admin key)" if admin_key else " (regular key)"))
    if st == 200:
        print(st, path.split("?")[0], "buckets/records:", len(body.get("data", [])), "next_page:", body.get("next_page"))
        for bucket in body.get("data", [])[:2]:
            print("   ", bucket.get("starting_at") or bucket.get("date"), str(bucket.get("results", bucket))[:300])
    else:
        print(st, path.split("?")[0], "->", body.get("error", {}).get("message") if isinstance(body, dict) else body)
if not admin_key:
    print("Set ANTHROPIC_ADMIN_KEY (sk-ant-admin01-…) in .env to run the reports for real (they are ACCOUNT_RESTRICTED with a regular key).")