Claude Platform Docs

Federation-Regel aktualisieren

$client->beta->organization->federation->rules->update(string federationRuleID, ?bool appliesToAllWorkspaces, ?array<string,string> attributes, ?string description, ?BetaFederationRuleMatch match, ?string name, ?string oauthScope, ?BetaServiceAccountTarget target, ?int tokenLifetimeSeconds, ?string workspaceID, ?list<AnthropicBeta> betas): BetaFederationRule
POST/v1/organizations/federation_rules/{federation_rule_id}

Erfordert ein OAuth-Access-Token mit dem Scope org:admin, aus ant auth login --scope org:admin oder einer Workload-Identity-Federation-Regel; Admin-API-Keys werden nicht akzeptiert. Siehe WIF mit der Admin API verwalten.

Aktualisiert eine Federation-Regel teilweise.

issuer_id ist unveränderlich. match und target werden als ganze Objekte ersetzt, wenn sie gesetzt werden. Referenzierte Service-Accounts und Workspaces müssen in deiner Organisation existieren; ungültige Verweise werden mit einem 400-Fehler abgelehnt. Archivierte Regeln können nicht aktualisiert werden; dies gibt 400 zurück. Erstelle stattdessen eine neue Regel. Regeln für bekannte gemeinsam genutzte Issuer (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) müssen die Mandantenidentität über einen identitätstragenden Claim, ein mandantenbindendes Subject-Präfix (wie repo:YOUR_ORG/...) oder eine CEL-Bedingung einschränken, die auf einen dieser Identitäts-Claims verweist (z. B. claims.repository_owner). Bei diesen Issuern wird die Anforderung bei jeder Aktualisierung erneut geprüft; wenn der gespeicherte Match einer bestehenden Regel die Mandantenidentität noch nicht einschränkt, muss jede Aktualisierung (selbst eine Umbenennung oder Beschreibungsänderung) in derselben Anfrage auch einen konformen match liefern. OAuth-Aufrufer dürfen nur Regeln verwalten, deren oauth_scope workspace:developer oder workspace:inference ist; andere Scopes erfordern eine Console-Sitzung.

Parameters
federationRuleID: string

ID of the federation rule to update.

appliesToAllWorkspaces?:optional bool

When true, enables this rule for every workspace in the org (including workspaces created later). Setting false is rejected with 400 if no workspace would remain enabled; a rule with only a legacy workspace_id binding continues to mint.

attributes?:optional array<string,string>

Replaces the CEL expressions {name: expr} extracting named values from claims. Send null to clear them. Not yet supported; any non-empty value is rejected with 400.

description?:optional string

Replaces the description. Omit to leave unchanged; send null to clear (the field is stored as an empty string).

match?:optional BetaFederationRuleMatch

Does the incoming JWT qualify?

All populated fields must pass; omitted fields are skipped. At least one of subject_prefix (other than a wildcard-only value like *), claims, or condition is required; audience alone is not sufficient.

name?:optional string

Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

oauthScope?:optional string

Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

target?:optional BetaServiceAccountTarget

Bind to a fixed service account by ID.

tokenLifetimeSeconds?:optional int

Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

workspaceID?:optional string

Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the /federation_rules/{federation_rule_id}/workspaces sub-resource instead.

betas?:optional list<AnthropicBeta>

Optional header to specify the beta version(s) you want to use.

Returns
class BetaFederationRule { $type = 'federation_rule'; $id; $appliesToAllWorkspaces; /* 17 more */ }
Federation-Regel aktualisieren
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

$client = new Client(apiKey: 'my-anthropic-api-key');

$betaFederationRule = $client->beta->organization->federation->rules->update(
  'federation_rule_id',
  appliesToAllWorkspaces: true,
  attributes: ['foo' => 'string'],
  description: 'description',
  match: [
    'audience' => 'audience',
    'claims' => ['foo' => 'string'],
    'condition' => 'condition',
    'subjectPrefix' => 'subject_prefix',
  ],
  name: 'x',
  oauthScope: 'x',
  target: [
    'serviceAccountID' => 'svac_01SDCCSbTxrXDpWc1phhtcfK',
    'type' => 'service_account',
    'serviceAccountName' => 'service_account_name',
  ],
  tokenLifetimeSeconds: 60,
  workspaceID: 'workspace_id',
  betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24],
);

var_dump($betaFederationRule);
Returns Examples
Response 200
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}