Claude Platform Docs

Federation-Regel erstellen

FederationRule Organization.Federation.Rules.Create(parameters, cancellationToken = default)
POST/v1/organizations/federation_rules

Erfordert ein OAuth-Zugriffstoken mit dem Scope org:admin, über ant auth login --scope org:admin oder eine Workload-Identity-Federation-Regel; Admin-API-Keys werden nicht akzeptiert. Siehe WIF mit der Admin API verwalten.

Erstellt eine Federation-Regel, die deiner Organisation gehört.

Der referenzierte Issuer und der Ziel-Service-Account müssen bereits in derselben Organisation existieren; ungültige Referenzen werden mit einem 400-Fehler abgelehnt. Die Workspace-Referenz wird validiert. Die Mitgliedschaft wird bei der Regelerstellung nicht geprüft: Der Token-Austausch löst pro Aufruf einen einzelnen aktivierten Workspace auf und wird abgelehnt, sofern der Ziel-Service-Account nicht Mitglied dieses Workspace ist (im Standard-Workspace ist er implizit Mitglied). Regeln für bekannte gemeinsam genutzte Issuer (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) müssen die Tenant-Identität über einen identitätstragenden Claim, ein Tenant-fixierendes Subject-Präfix (wie repo:YOUR_ORG/...) oder eine CEL-Bedingung einschränken, die auf einen dieser Identitäts-Claims verweist (z. B. claims.repository_owner). OAuth-Aufrufer dürfen nur Regeln verwalten, deren oauth_scope workspace:developer oder workspace:inference ist; andere Scopes erfordern eine Console-Sitzung.

Parameters
RuleCreateParams parameters
required string issuerID

Tagged ID of the federation issuer.

required FederationRuleMatch match

Conditions the verified JWT must satisfy for this rule to apply. At least one of subject_prefix (other than a wildcard-only value like *), claims, or condition is required; audience alone is not sufficient.

required string name

Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength1
maxLength255
required string oauthScope

Space-separated OAuth scopes. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

minLength1
required ServiceAccountTarget target

Identity that tokens minted via this rule act as. Currently always a service_account target.

bool appliesToAllWorkspaces

When true, enable this rule for every workspace in the org (including workspaces created later).

string? description

Optional free-text description.

maxLength2000
long tokenLifetimeSeconds

Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

minimum60
maximum86400
string? workspaceID

Tagged ID of the workspace to enable this rule for. Required unless applies_to_all_workspaces is true. Additional workspaces can be added via the /federation_rules/{federation_rule_id}/workspaces sub-resource.

Returns
class FederationRule { Type = "federation_rule"; ID; AppliesToAllWorkspaces; /* 15 more */ }

Authorization rule binding an external OIDC identity to Anthropic.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

Federation-Regel erstellen
using System;
using System.Collections.Generic;
using Anthropic.Models.Organization.Federation.Rules;

RuleCreateParams parameters = new()
{
    IssuerID = "issuer_id",
    Match = new()
    {
        Audience = "audience",
        Claims = new Dictionary<string, string>() { { "foo", "string" } },
        Condition = "condition",
        SubjectPrefix = "subject_prefix",
    },
    Name = "x",
    OAuthScope = "x",
    Target = new()
    {
        ServiceAccountID = "svac_01SDCCSbTxrXDpWc1phhtcfK",
        ServiceAccountName = "service_account_name",
    },
};

var federationRule = await client.Organization.Federation.Rules.Create(parameters);

Console.WriteLine(federationRule);
Returns Examples
Response 200
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}