Organization

Retrieve information about the organization associated with the authenticated API key.

Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to API keys in the Claude Console.

Create an external key config owned by the caller's organization.

List external key configs in the caller's organization.

Retrieve a single external key config in the caller's organization by ID.

Partially update an external key config. Omitted fields are left unchanged.

Delete an external key config.

Validate an external key config against the customer's KMS.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Invite a user to join the organization by email.

List the organization's invites.

Retrieve an invite by ID.

Delete a pending invite.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

List the organization's members.

Retrieve a member of the organization by user ID.

Update a member's organization role.

Remove a member from the organization.

List a workspace's rate limits.

Set or clear rate-limit overrides for one rate-limit group in a workspace.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

List Messages API rate limits for your organization.

Retrieve your organization's Compliance Settings.

Update your organization's Compliance Settings.

[Legacy] Get a report of your organization's Messages API usage, aggregated into time buckets.

Retrieve daily aggregated usage metrics for Claude Code users. Enables organizations to analyze developer productivity and build custom dashboards.

[Legacy] Get a report of your organization's Claude API costs in USD, aggregated into daily buckets.

Get organization-wide activity summaries for a date range.

Get per-user activity for a given day, with cursor-based pagination.

Get per-project activity for a given day, with cursor-based pagination.

Get per-connector usage for a given day, with cursor-based pagination.

Get per-plugin install + invocation usage for a given day, with pagination.

Get per-skill usage for a given day, with cursor-based pagination.

Get artifact-creation activity for a given day, broken out by MIME type.

Get token usage across a date range, broken out by dimension.

Get cost in USD across a date range, broken out by dimension.

[Legacy] Get token usage over time across a date range.

[Legacy] Get per-user token usage across a date range.

[Legacy] Get cost in USD over time across a date range.

[Legacy] Get per-user cost in USD across a date range.

Set a spend limit.

Retrieve a spend limit by ID.

Delete a spend limit.

List the organization's spend limits.

List each member's effective spend limit and period-to-date spend.

List spend limit increase requests, most recent first.

Retrieve a spend limit increase request.

Approve a pending spend limit increase request.

Deny a pending spend limit increase request.

Create an RBAC Group in the Claude Enterprise tenant. Groups created via the API have source type "direct".

List RBAC Groups in the Claude Enterprise tenant.

Retrieve an RBAC Group by ID.

Update an RBAC Group's name. Groups provisioned by an identity provider (source type "scim") cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

Delete an RBAC Group. Groups provisioned by an identity provider (source type "scim") cannot be deleted via the API while an organization in the tenant uses SCIM provisioning.

List members of an RBAC Group.

Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type "scim") cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type "scim") cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

List RBAC Roles in the organization.

Retrieve an RBAC Role by ID.

List the permissions an RBAC Role grants.

Create an organization-owned Plugin and its first version by uploading the version's files.

Retrieve a Plugin by ID.

Change which stored version of an organization-owned Plugin is served to members, for example to roll back to an earlier one. This pins the served version: later uploads are stored but no longer change what is served, and pinning cannot currently be undone, here or in claude.ai.

List the Plugins created under the organization, newest first: those in the organization's own plugin marketplaces and those in members' personal plugin marketplaces.

Permanently delete a Plugin and every version it holds, exactly as when an administrator deletes it in claude.ai. The Plugin may belong to the organization or to a member, including a member who has since left the organization.

Add a version to an organization-owned Plugin by uploading the new version's files; it becomes the version served to members unless the Plugin's served version has been pinned.

List a Plugin's versions, newest first.

Retrieve one version of a Plugin by its ID, or the Plugin's newest version.

Download one version's .zip archive, exactly as stored. Each download of a Plugin from a member's personal plugin marketplace is recorded on the Compliance API activity feed.

List an organization-owned Plugin's installation settings, which say which members it is for, most recently created first.

Set or change an organization-owned Plugin's installation setting for the whole organization or for one RBAC Group.

Remove an organization-owned Plugin's own installation setting for the whole organization or for one RBAC Group.

List the shares the owner of a member-owned Plugin has given — to every member of the organization, to an RBAC Group, or to one member — most recently granted first.

List the plugin marketplaces Plugins live in, newest first: the organization's own and its members' personal ones.

Retrieve a plugin marketplace by ID.

Set the default installation setting of one of the organization's own plugin marketplaces. Every Plugin in it without a setting of its own gets this default as its organization-wide setting, including Plugins added later.

Check whether a plugin marketplace held in a public GitHub repository would synchronize into claude.ai, without connecting or storing it.

Check whether a plugin marketplace, uploaded as a .zip of the marketplace directory, would synchronize into claude.ai, without connecting or storing it.

Register an OpenTelemetry destination for the organization.

List the organization's destinations, newest first, optionally only those that cover given workspaces.

Read a destination's configuration, state, and most recent delivery results.

Change a telemetry destination's settings, its state, or which workspaces it covers.

Delete a destination and its workspace list.

Send one test span, named anthropic.test, to the destination with its registered headers, once and without retries, and report the destination's answer. The response is 200 whether or not the destination answered with a 2xx status: its result has the type success, or the type failure and the reason in error. The destination's configuration, state and delivery_health do not change. A disabled destination can be tested too. Wait 10 seconds between tests of one destination; a request that comes sooner may be answered with status 429.

List the workspaces on a destination's workspace list, newest entry first.

Add one workspace to a destination's workspace list.

Remove one workspace from a destination's workspace list.

Create an organization webhook endpoint.

List the organization's webhook endpoints.

Retrieve an organization webhook endpoint by ID.

Update an organization webhook endpoint. Only the fields you send are changed.

Delete an organization webhook endpoint.

Replace an organization webhook endpoint's signing secret. The old secret stops working immediately. The new secret is returned only in this response.

Set a Slack channel up for Claude Tag and return it with its identifier. If the channel is already set up, whether in claude.ai, by Claude's first use in it or by an earlier request, the existing channel is returned, so the request can be repeated. settings, when sent, is applied as an update applies it. Before a channel is set up, Claude's Slack app confirms with Slack that the channel is in the workspace, is not archived and is visible to the app; a channel that fails the confirmation returns 404. Setting the channel up and applying settings are two steps: when the second is refused, the response is the refusal, the channel stays set up with every setting unset, and the error's details.slack_channel_id holds the channel's identifier.

List the set-up Slack channels of one Slack workspace, newest first by created_at. A channel that is not set up is not listed: Slack holds the full list of a workspace's channels. Pass slack_channel_id as well to look one channel up by its Slack identifiers: data then holds that channel, or is empty when it is not set up, and limit and page are ignored. A workspace that the organization owns only through a Slack Enterprise Grid returns 404 until it is set up. With include_inherited=true each channel's settings holds what applies in it, and the request fails with 503 rather than resolve against a settings level that could not be read. A page cursor resumes only a request with the same include_inherited.

Get one Slack channel and its settings. By default settings holds what the channel itself stores: a setting that is null there is not set on the channel and is inherited. With include_inherited=true, settings holds what applies in the channel once the settings levels above it are taken into account, and the request fails with 503 rather than resolve against a settings level that could not be read. Either way sources names the settings level each value comes from, so a caller tells the channel's own value from an inherited one by its source, not by whether it is null.

Change the settings a Slack channel stores. The update is partial: a setting left out is unchanged, and a setting sent as null is cleared, so the channel inherits it. If any value is refused, no setting in the request is stored. A group direct message takes no settings and returns 400.

Remove a Slack channel from Claude Tag. This deletes the channel's stored settings and its Bundle Targets at once, and then, in the background, the channel's sessions and their transcripts, its memory, its routines and the artifacts published from it. None of it can be restored. The channel in Slack and its messages are unchanged. The request is refused with 400 and error.details.error_code slack_channel_enabled while enabled resolves to true for the channel, as a read with include_inherited=true returns it: set enabled to false on the channel first. This guards against removing a channel in use by mistake; it is not a way to keep Claude out, because the removal deletes the channel's own enabled: false with its other settings, after which the channel inherits again and Claude's next use of it can set it up anew with a new identifier. The identifier returns 404 as soon as the request returns, so a repeated removal returns 404. A group direct message returns 400, and so does a channel that holds configuration this API does not manage.

List the set-up Slack workspaces the organization owns, newest first by created_at. Pass slack_workspace_id to look one workspace up by its Slack identifier: data then holds that workspace, or is empty when it is not set up. A workspace of a Slack Enterprise Grid the organization has connected returns 404 until it is set up. With include_inherited=true each workspace's settings holds what applies in it, and the request fails with 503 rather than resolve against a settings level that could not be read. A page cursor resumes only a request with the same include_inherited.

Get one Slack workspace and its settings. By default settings holds what the workspace itself stores: a setting that is null there is not set on the workspace and is inherited. With include_inherited=true, settings holds what applies in the workspace once the organization's Slack defaults are taken into account, and the request fails with 503 rather than resolve against a settings level that could not be read. Either way sources names the settings level each value comes from.

Change the settings a Slack workspace stores. The update is partial: a setting left out is unchanged, and a setting sent as null is cleared, so the workspace inherits it. If any value is refused, no setting in the request is stored.

List the organization's Bundles, newest first by created_at. A Bundle that Claude Tag manages for itself is not listed.

Get one Bundle. What the Bundle grants (connectors, repositories and credentials) is never returned.

List the Slack channels and Slack workspaces a Bundle is attached to, newest first by created_at. Only channels and workspaces the organization owns are listed; a Bundle that is attached to anything else has no Bundle Target for it.

Attach a Bundle to a Slack channel or a Slack workspace. A Bundle attached to a workspace can be used in the workspace and in every channel in it. Attaching a Bundle to a channel or workspace it is already attached to returns the existing Bundle Target. The channel or workspace must be set up: attaching never sets a channel up. A group direct message takes no Bundle and returns 400.

Get one Bundle Target. Returns 404 when target_id is the identifier of another Bundle's Bundle Target, or the Bundle Target was detached.

Detach a Bundle from a Slack channel or a Slack workspace. A repeated detach returns 404.