---
title: Organization
url: https://platform.claude.com/docs/en/api/php/organization
---

# Organization

## Get Current Organization

`$client->organization->retrieve(): OrganizationInfo`

**GET** `/v1/organizations/me`

Retrieve information about the organization associated with the authenticated API key.

### Returns

- `class OrganizationInfo`

  - `"organization" type`

    Object type.

    For Organizations, this is always `"organization"`.

  - `string id`

    ID of the Organization.

  - `string name`

    Name of the Organization.

### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$organizationInfo = $client->organization->retrieve();

var_dump($organizationInfo);
```

#### Response (200)

```json
{
  "id": "12345678-1234-5678-1234-567812345678",
  "name": "Organization Name",
  "type": "organization"
}
```

## Domain types

### Organization Info

- `class OrganizationInfo`

  - `"organization" type`

    Object type.

    For Organizations, this is always `"organization"`.

  - `string id`

    ID of the Organization.

  - `string name`

    Name of the Organization.

### Organization Role

- `enum OrganizationRole`

  - `"admin"`

  - `"billing"`

  - `"claude_code_user"`

  - `"developer"`

  - `"managed"`

  - `"membership_admin"`

  - `"owner"`

  - `"primary_owner"`

  - `"user"`

## Organization › API Keys

### List API Keys

`$client->organization->apiKeys->list(?string afterID, ?string beforeID, ?string createdByUserID, ?int limit, ?Status status, ?string workspaceID): Page<APIKey>`

**GET** `/v1/organizations/api_keys`

List API Keys

#### Parameters

- `afterID?: optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.

- `beforeID?: optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.

- `createdByUserID?: optional string` (query parameter)

  Filter by the ID of the User who created the object.

- `limit?: optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

- `status?: optional Status` (query parameter)

  Filter by API key status.

- `workspaceID?: optional string` (query parameter)

  Filter by Workspace ID.

#### Returns

- `class APIKey`

  - `"api_key" type`

    Object type.

    For API Keys, this is always `"api_key"`.

  - `string id`

    ID of the API key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the API Key was created.

  - `?APIKeyCreatedBy createdBy`

    The ID and type of the actor that created the API key, or `null` when the
    creator is not recorded (legacy, workload-identity-federated, or
    system-created keys).

  - `?\Datetime expiresAt`

    RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.

  - `string name`

    Name of the API key.

  - `?string partialKeyHint`

    Partially redacted hint for the API key.

  - `?Principal principal`

    The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.

  - `Scope scope`

    Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.

  - `Status status`

    Status of the API key.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->apiKeys->list(
  afterID: 'after_id',
  beforeID: 'before_id',
  createdByUserID: 'created_by_user_id',
  limit: 1,
  status: 'active',
  workspaceID: 'workspace_id',
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by": {
        "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
        "type": "user"
      },
      "expires_at": "2024-10-30T23:58:27.427722Z",
      "name": "Developer Key",
      "partial_key_hint": "sk-ant-api03-R2D...igAA",
      "principal": {
        "type": "user_actor",
        "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
      },
      "scope": {
        "type": "workspace",
        "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
      },
      "status": "active",
      "type": "api_key"
    }
  ],
  "first_id": "first_id",
  "has_more": true,
  "last_id": "last_id"
}
```

### Retrieve API Key (Admin API)

`$client->organization->apiKeys->retrieve(string apiKeyID): APIKey`

**GET** `/v1/organizations/api_keys/{api_key_id}`

Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to [API keys](https://platform.claude.com/settings/keys) in the Claude Console.

#### Parameters

- `apiKeyID: string` (path parameter)

  ID of the API key.

#### Returns

- `class APIKey`

  - `"api_key" type`

    Object type.

    For API Keys, this is always `"api_key"`.

  - `string id`

    ID of the API key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the API Key was created.

  - `?APIKeyCreatedBy createdBy`

    The ID and type of the actor that created the API key, or `null` when the
    creator is not recorded (legacy, workload-identity-federated, or
    system-created keys).

  - `?\Datetime expiresAt`

    RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.

  - `string name`

    Name of the API key.

  - `?string partialKeyHint`

    Partially redacted hint for the API key.

  - `?Principal principal`

    The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.

  - `Scope scope`

    Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.

  - `Status status`

    Status of the API key.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$apiKey = $client->organization->apiKeys->retrieve('api_key_id');

var_dump($apiKey);
```

##### Response (200)

```json
{
  "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by": {
    "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
    "type": "user"
  },
  "expires_at": "2024-10-30T23:58:27.427722Z",
  "name": "Developer Key",
  "partial_key_hint": "sk-ant-api03-R2D...igAA",
  "principal": {
    "type": "user_actor",
    "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
  },
  "scope": {
    "type": "workspace",
    "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
  },
  "status": "active",
  "type": "api_key"
}
```

### Update API Key

`$client->organization->apiKeys->update(string apiKeyID, ?string name, ?Status status): APIKey`

**POST** `/v1/organizations/api_keys/{api_key_id}`

Update API Key

#### Parameters

- `apiKeyID: string` (path parameter)

  ID of the API key.

- `name?: optional string`

  Name of the API key.

- `status?: optional Status`

  Status of the API key.

#### Returns

- `class APIKey`

  - `"api_key" type`

    Object type.

    For API Keys, this is always `"api_key"`.

  - `string id`

    ID of the API key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the API Key was created.

  - `?APIKeyCreatedBy createdBy`

    The ID and type of the actor that created the API key, or `null` when the
    creator is not recorded (legacy, workload-identity-federated, or
    system-created keys).

  - `?\Datetime expiresAt`

    RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.

  - `string name`

    Name of the API key.

  - `?string partialKeyHint`

    Partially redacted hint for the API key.

  - `?Principal principal`

    The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.

  - `Scope scope`

    Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.

  - `Status status`

    Status of the API key.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$apiKey = $client->organization->apiKeys->update(
  'api_key_id', name: 'x', status: 'active'
);

var_dump($apiKey);
```

##### Response (200)

```json
{
  "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by": {
    "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
    "type": "user"
  },
  "expires_at": "2024-10-30T23:58:27.427722Z",
  "name": "Developer Key",
  "partial_key_hint": "sk-ant-api03-R2D...igAA",
  "principal": {
    "type": "user_actor",
    "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
  },
  "scope": {
    "type": "workspace",
    "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
  },
  "status": "active",
  "type": "api_key"
}
```

## Organization › External Keys

### Create External Key

`$client->organization->externalKeys->create(ProviderConfig providerConfig, ?string displayName, ?Geo geo, ?string userProfileID): ExternalKey`

**POST** `/v1/organizations/external_keys`

Create an external key config owned by the caller's organization.

#### Parameters

- `providerConfig: ProviderConfig`

  KMS provider identity and auth coordinates.

- `displayName?: optional string`

  Human-friendly display name.

- `geo?: optional Geo`

  Data residency geo. Only `us` is supported.

- `userProfileID?: optional string`

  ID of a user profile to bind the key to. Omit this field for a key that isn't bound to a user profile. Such a key can be attached to a Workspace whatever its user profile. The binding cannot be changed later. A key bound to a user profile can only be attached to a Workspace that has the same user profile.

#### Returns

- `class ExternalKey`

  - `"external_key" type`

  - `string id`

    Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.

  - `Attachment attachment`

    Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.

  - `\Datetime createdAt`

  - `?string displayName`

    Human-friendly display name. Null if none was set.

  - `string geo`

    Data residency geo. Selects the region this key is used in.

  - `ProviderConfig providerConfig`

    KMS provider identity and auth coordinates.

  - `\Datetime updatedAt`

  - `?string userProfileID`

    ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$externalKey = $client->organization->externalKeys->create(
  providerConfig: [
    'kmsARN' => 'arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222',
    'type' => 'aws',
    'region' => 'us-east-1',
  ],
  displayName: 'x',
  geo: 'us',
  userProfileID: 'uprof_01SDCCSbTxrXDpWc1phhtcfK',
);

var_dump($externalKey);
```

##### Response (200)

```json
{
  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "attachment": {
    "type": "attached"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "prod-us-key",
  "geo": "us",
  "provider_config": {
    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
    "type": "aws",
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
  },
  "type": "external_key",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
}
```

### List External Keys

`$client->organization->externalKeys->list(?int limit, ?string page): PageCursor<ExternalKey>`

**GET** `/v1/organizations/external_keys`

List external key configs in the caller's organization.

Results are ordered by creation time (newest first). Use the
`next_page` cursor from the response to fetch subsequent pages.

#### Parameters

- `limit?: optional int` (query parameter)

  Number of results per page.

  default: 20

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class ExternalKey`

  - `"external_key" type`

  - `string id`

    Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.

  - `Attachment attachment`

    Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.

  - `\Datetime createdAt`

  - `?string displayName`

    Human-friendly display name. Null if none was set.

  - `string geo`

    Data residency geo. Selects the region this key is used in.

  - `ProviderConfig providerConfig`

    KMS provider identity and auth coordinates.

  - `\Datetime updatedAt`

  - `?string userProfileID`

    ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->externalKeys->list(limit: 1, page: 'page');

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
      "attachment": {
        "type": "attached"
      },
      "created_at": "2024-10-30T23:58:27.427722Z",
      "display_name": "prod-us-key",
      "geo": "us",
      "provider_config": {
        "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
        "type": "aws",
        "region": "us-east-1",
        "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
      },
      "type": "external_key",
      "updated_at": "2024-10-30T23:58:27.427722Z",
      "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
    }
  ],
  "next_page": "next_page"
}
```

### Get External Key

`$client->organization->externalKeys->retrieve(string externalKeyID): ExternalKey`

**GET** `/v1/organizations/external_keys/{external_key_id}`

Retrieve a single external key config in the caller's organization by ID.

#### Parameters

- `externalKeyID: string` (path parameter)

  ID of the External Key.

#### Returns

- `class ExternalKey`

  - `"external_key" type`

  - `string id`

    Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.

  - `Attachment attachment`

    Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.

  - `\Datetime createdAt`

  - `?string displayName`

    Human-friendly display name. Null if none was set.

  - `string geo`

    Data residency geo. Selects the region this key is used in.

  - `ProviderConfig providerConfig`

    KMS provider identity and auth coordinates.

  - `\Datetime updatedAt`

  - `?string userProfileID`

    ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$externalKey = $client->organization->externalKeys->retrieve('external_key_id');

var_dump($externalKey);
```

##### Response (200)

```json
{
  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "attachment": {
    "type": "attached"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "prod-us-key",
  "geo": "us",
  "provider_config": {
    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
    "type": "aws",
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
  },
  "type": "external_key",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
}
```

### Update External Key

`$client->organization->externalKeys->update(string externalKeyID, ?string displayName, ?Geo geo, ?ProviderConfig providerConfig): ExternalKey`

**POST** `/v1/organizations/external_keys/{external_key_id}`

Partially update an external key config. Omitted fields are left unchanged.

`display_name` is always editable. `geo` and `provider_config` cannot
be changed once any workspace references this config, because previously
encrypted data requires the original key identity to decrypt.

#### Parameters

- `externalKeyID: string` (path parameter)

  ID of the External Key.

- `displayName?: optional string`

  Human-friendly display name.

- `geo?: optional Geo`

  Data residency geo. Only `us` is supported.

- `providerConfig?: optional ProviderConfig`

  KMS provider identity and auth coordinates.

#### Returns

- `class ExternalKey`

  - `"external_key" type`

  - `string id`

    Identifier of the external key config: a tagged ID prefixed `ekey_`, or, on Claude Platform on AWS, an AWS KMS key's ARN.

  - `Attachment attachment`

    Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.

  - `\Datetime createdAt`

  - `?string displayName`

    Human-friendly display name. Null if none was set.

  - `string geo`

    Data residency geo. Selects the region this key is used in.

  - `ProviderConfig providerConfig`

    KMS provider identity and auth coordinates.

  - `\Datetime updatedAt`

  - `?string userProfileID`

    ID of the user profile the key is bound to, or null if the key is not bound to one. A key bound to a user profile can only be attached to a Workspace that has the same user profile. A key that isn't bound can be attached to a Workspace whatever its user profile.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$externalKey = $client->organization->externalKeys->update(
  'external_key_id',
  displayName: 'x',
  geo: 'us',
  providerConfig: [
    'kmsARN' => 'arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222',
    'type' => 'aws',
    'region' => 'us-east-1',
  ],
);

var_dump($externalKey);
```

##### Response (200)

```json
{
  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "attachment": {
    "type": "attached"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "prod-us-key",
  "geo": "us",
  "provider_config": {
    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
    "type": "aws",
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
  },
  "type": "external_key",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
}
```

### Delete External Key

`$client->organization->externalKeys->delete(string externalKeyID): ExternalKeyDeleteResponse`

**DELETE** `/v1/organizations/external_keys/{external_key_id}`

Delete an external key config.

The request is rejected if any workspace still references this config.

#### Parameters

- `externalKeyID: string` (path parameter)

  ID of the External Key.

#### Returns

- `class ExternalKeyDeleteResponse`

  - `"external_key_deleted" type`

  - `string id`

    ID of the deleted External Key.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$externalKey = $client->organization->externalKeys->delete('external_key_id');

var_dump($externalKey);
```

##### Response (200)

```json
{
  "id": "ekey_01AbCdEfGhIjKlMnOpQrStUv",
  "type": "external_key_deleted"
}
```

### Validate External Key

`$client->organization->externalKeys->validate(string externalKeyID): ExternalKeyValidateResponse`

**POST** `/v1/organizations/external_keys/{external_key_id}/validate`

Validate an external key config against the customer's KMS.

Anthropic performs an encrypt/decrypt roundtrip against the configured
KMS key and waits up to 30 seconds for the result. The response status is
`success` if the roundtrip succeeded, or `failure` with an error
message if it failed or timed out.

#### Parameters

- `externalKeyID: string` (path parameter)

  ID of the External Key.

#### Returns

- `class ExternalKeyValidateResponse`

  - `"external_key_validation" type`

  - `?string error`

    Error message when status is `failure`. Null otherwise.

  - `Status status`

    `success` — encrypt/decrypt roundtrip succeeded. `failure` — the roundtrip failed or timed out; see `error`.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$response = $client->organization->externalKeys->validate('external_key_id');

var_dump($response);
```

##### Response (200)

```json
{
  "error": "error",
  "status": "failure",
  "type": "external_key_validation"
}
```

## Organization › Federation › Issuers

### Create Federation Issuer

`$client->organization->federation->issuers->create(string issuerURL, string name, ?bool checkJTI, ?JWKS jwks, ?int maxJWTLifetimeSeconds): FederationIssuer`

**POST** `/v1/organizations/federation_issuers`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Register an OIDC issuer that Anthropic will trust for workload identity
federation in your organization.

The `jwks` field controls how the issuer's signing keys are obtained and
takes one of three shapes selected by `type`: `discovery` (resolve keys
through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS
URL), or `inline` (provide a static key set). When `jwks.type` is
`discovery` and no `discovery_base` is set, the issuer URL must be
publicly reachable over HTTPS so Anthropic can fetch the discovery
document; for `explicit_url` and `inline` modes the issuer URL is only
matched as the JWT's `iss` claim and is not fetched.

#### Parameters

- `issuerURL: string`

  The `iss` claim value to match against.

- `name: string`

  Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

- `checkJTI?: optional bool`

  Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.

- `jwks?: optional JWKS`

  How signing keys are obtained. Defaults to OIDC discovery.

- `maxJWTLifetimeSeconds?: optional int`

  Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.

#### Returns

- `class FederationIssuer`

  - `"federation_issuer" type`

  - `string id`

    Tagged ID of the federation issuer.

  - `?\Datetime archivedAt`

    If set, all rules referencing this issuer reject token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.

  - `bool checkJTI`

    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.

  - `\Datetime createdAt`

    When this issuer was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.

  - `string issuerURL`

    The `iss` claim value. Incoming JWTs must match exactly.

  - `JWKS jwks`

    How signing keys are obtained for signature verification.

  - `?\Datetime jwksPollingDisabledAt`

    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.

  - `int maxJWTLifetimeSeconds`

    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.

  - `string name`

    Admin-chosen slug identifier.

  - `?FederationIssuerPollStatus pollStatus`

    Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

  - `\Datetime updatedAt`

    When this issuer was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationIssuer = $client->organization->federation->issuers->create(
  issuerURL: 'x',
  name: 'x',
  checkJTI: true,
  jwks: [
    'type' => 'discovery',
    'caCertPEM' => 'ca_cert_pem',
    'discoveryBase' => 'discovery_base',
  ],
  maxJWTLifetimeSeconds: 1,
);

var_dump($federationIssuer);
```

##### Response (200)

```json
{
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "check_jti": true,
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "jwks": {
    "type": "discovery",
    "ca_cert_pem": "ca_cert_pem",
    "discovery_base": "discovery_base"
  },
  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
  "max_jwt_lifetime_seconds": 0,
  "name": "github-actions",
  "poll_status": {
    "consecutive_failures": 0,
    "last_fetched_at": "2019-12-27T18:11:19.117Z",
    "next_poll_at": "2019-12-27T18:11:19.117Z"
  },
  "type": "federation_issuer",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

### List Federation Issuers

`$client->organization->federation->issuers->list(?bool includeArchived, ?int limit, ?string page): PageCursor<FederationIssuer>`

**GET** `/v1/organizations/federation_issuers`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

List federation issuers in your organization.

Archived issuers are excluded unless `include_archived=true`.

#### Parameters

- `includeArchived?: optional bool` (query parameter)

  Include archived resources. Defaults to false.

  default: false

- `limit?: optional int` (query parameter)

  Number of results per page.

  default: 20

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class FederationIssuer`

  - `"federation_issuer" type`

  - `string id`

    Tagged ID of the federation issuer.

  - `?\Datetime archivedAt`

    If set, all rules referencing this issuer reject token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.

  - `bool checkJTI`

    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.

  - `\Datetime createdAt`

    When this issuer was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.

  - `string issuerURL`

    The `iss` claim value. Incoming JWTs must match exactly.

  - `JWKS jwks`

    How signing keys are obtained for signature verification.

  - `?\Datetime jwksPollingDisabledAt`

    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.

  - `int maxJWTLifetimeSeconds`

    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.

  - `string name`

    Admin-chosen slug identifier.

  - `?FederationIssuerPollStatus pollStatus`

    Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

  - `\Datetime updatedAt`

    When this issuer was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->federation->issuers->list(
  includeArchived: true, limit: 1, page: 'page'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
      "archived_at": "2019-12-27T18:11:19.117Z",
      "archived_by_actor_id": "archived_by_actor_id",
      "check_jti": true,
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by_actor_id": "created_by_actor_id",
      "issuer_url": "https://token.actions.githubusercontent.com",
      "jwks": {
        "type": "discovery",
        "ca_cert_pem": "ca_cert_pem",
        "discovery_base": "discovery_base"
      },
      "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
      "max_jwt_lifetime_seconds": 0,
      "name": "github-actions",
      "poll_status": {
        "consecutive_failures": 0,
        "last_fetched_at": "2019-12-27T18:11:19.117Z",
        "next_poll_at": "2019-12-27T18:11:19.117Z"
      },
      "type": "federation_issuer",
      "updated_at": "2024-10-30T23:58:27.427722Z",
      "updated_by_actor_id": "updated_by_actor_id"
    }
  ],
  "next_page": "next_page"
}
```

### Get Federation Issuer

`$client->organization->federation->issuers->retrieve(string federationIssuerID): FederationIssuer`

**GET** `/v1/organizations/federation_issuers/{federation_issuer_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Retrieve a federation issuer by its ID (`fdis_...`).

#### Parameters

- `federationIssuerID: string` (path parameter)

  ID of the federation issuer.

#### Returns

- `class FederationIssuer`

  - `"federation_issuer" type`

  - `string id`

    Tagged ID of the federation issuer.

  - `?\Datetime archivedAt`

    If set, all rules referencing this issuer reject token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.

  - `bool checkJTI`

    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.

  - `\Datetime createdAt`

    When this issuer was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.

  - `string issuerURL`

    The `iss` claim value. Incoming JWTs must match exactly.

  - `JWKS jwks`

    How signing keys are obtained for signature verification.

  - `?\Datetime jwksPollingDisabledAt`

    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.

  - `int maxJWTLifetimeSeconds`

    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.

  - `string name`

    Admin-chosen slug identifier.

  - `?FederationIssuerPollStatus pollStatus`

    Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

  - `\Datetime updatedAt`

    When this issuer was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationIssuer = $client->organization->federation->issuers->retrieve(
  'federation_issuer_id'
);

var_dump($federationIssuer);
```

##### Response (200)

```json
{
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "check_jti": true,
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "jwks": {
    "type": "discovery",
    "ca_cert_pem": "ca_cert_pem",
    "discovery_base": "discovery_base"
  },
  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
  "max_jwt_lifetime_seconds": 0,
  "name": "github-actions",
  "poll_status": {
    "consecutive_failures": 0,
    "last_fetched_at": "2019-12-27T18:11:19.117Z",
    "next_poll_at": "2019-12-27T18:11:19.117Z"
  },
  "type": "federation_issuer",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

### Update Federation Issuer

`$client->organization->federation->issuers->update(string federationIssuerID, ?bool checkJTI, ?string issuerURL, ?JWKS jwks, ?bool jwksPollingDisabled, ?int maxJWTLifetimeSeconds, ?string name): FederationIssuer`

**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Partially update a federation issuer.

Setting `jwks` replaces the full JWKS shape at once. Archived issuers
cannot be updated; this returns 400. Create a new issuer instead.

Updating an issuer that backs a rule with a scope outside
`workspace:developer` or `workspace:inference` requires a Console
session.

#### Parameters

- `federationIssuerID: string` (path parameter)

  ID of the federation issuer to update.

- `checkJTI?: optional bool`

  Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.

- `issuerURL?: optional string`

  Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity.

- `jwks?: optional JWKS`

  Replaces the entire JWKS configuration.

- `jwksPollingDisabled?: optional bool`

  Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected.

- `maxJWTLifetimeSeconds?: optional int`

  Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.

- `name?: optional string`

  Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

#### Returns

- `class FederationIssuer`

  - `"federation_issuer" type`

  - `string id`

    Tagged ID of the federation issuer.

  - `?\Datetime archivedAt`

    If set, all rules referencing this issuer reject token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.

  - `bool checkJTI`

    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.

  - `\Datetime createdAt`

    When this issuer was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.

  - `string issuerURL`

    The `iss` claim value. Incoming JWTs must match exactly.

  - `JWKS jwks`

    How signing keys are obtained for signature verification.

  - `?\Datetime jwksPollingDisabledAt`

    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.

  - `int maxJWTLifetimeSeconds`

    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.

  - `string name`

    Admin-chosen slug identifier.

  - `?FederationIssuerPollStatus pollStatus`

    Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

  - `\Datetime updatedAt`

    When this issuer was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationIssuer = $client->organization->federation->issuers->update(
  'federation_issuer_id',
  checkJTI: true,
  issuerURL: 'x',
  jwks: [
    'type' => 'discovery',
    'caCertPEM' => 'ca_cert_pem',
    'discoveryBase' => 'discovery_base',
  ],
  jwksPollingDisabled: true,
  maxJWTLifetimeSeconds: 1,
  name: 'x',
);

var_dump($federationIssuer);
```

##### Response (200)

```json
{
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "check_jti": true,
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "jwks": {
    "type": "discovery",
    "ca_cert_pem": "ca_cert_pem",
    "discovery_base": "discovery_base"
  },
  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
  "max_jwt_lifetime_seconds": 0,
  "name": "github-actions",
  "poll_status": {
    "consecutive_failures": 0,
    "last_fetched_at": "2019-12-27T18:11:19.117Z",
    "next_poll_at": "2019-12-27T18:11:19.117Z"
  },
  "type": "federation_issuer",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

### Archive Federation Issuer

`$client->organization->federation->issuers->archive(string federationIssuerID): FederationIssuer`

**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Archive a federation issuer.

Idempotent; re-archiving returns the issuer with its original
`archived_at`. Rejected with 400 if any live (non-archived) federation
rule still references the issuer; archive those rules first (a rule's
issuer cannot be changed), or recreate them against another issuer.

#### Parameters

- `federationIssuerID: string` (path parameter)

  ID of the federation issuer to archive.

#### Returns

- `class FederationIssuer`

  - `"federation_issuer" type`

  - `string id`

    Tagged ID of the federation issuer.

  - `?\Datetime archivedAt`

    If set, all rules referencing this issuer reject token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.

  - `bool checkJTI`

    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.

  - `\Datetime createdAt`

    When this issuer was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.

  - `string issuerURL`

    The `iss` claim value. Incoming JWTs must match exactly.

  - `JWKS jwks`

    How signing keys are obtained for signature verification.

  - `?\Datetime jwksPollingDisabledAt`

    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.

  - `int maxJWTLifetimeSeconds`

    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.

  - `string name`

    Admin-chosen slug identifier.

  - `?FederationIssuerPollStatus pollStatus`

    Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

  - `\Datetime updatedAt`

    When this issuer was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationIssuer = $client->organization->federation->issuers->archive(
  'federation_issuer_id'
);

var_dump($federationIssuer);
```

##### Response (200)

```json
{
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "check_jti": true,
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "jwks": {
    "type": "discovery",
    "ca_cert_pem": "ca_cert_pem",
    "discovery_base": "discovery_base"
  },
  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
  "max_jwt_lifetime_seconds": 0,
  "name": "github-actions",
  "poll_status": {
    "consecutive_failures": 0,
    "last_fetched_at": "2019-12-27T18:11:19.117Z",
    "next_poll_at": "2019-12-27T18:11:19.117Z"
  },
  "type": "federation_issuer",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

## Organization › Federation › Rules

### Create Federation Rule

`$client->organization->federation->rules->create(string issuerID, FederationRuleMatch match, string name, string oauthScope, ServiceAccountTarget target, ?bool appliesToAllWorkspaces, ?string description, ?int tokenLifetimeSeconds, ?string workspaceID): FederationRule`

**POST** `/v1/organizations/federation_rules`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Create a federation rule owned by your organization.

The referenced issuer and the target service account must already exist
in the same organization; invalid references are rejected with a 400
error. The workspace reference is validated. Membership is not checked
at rule creation: token exchange resolves a single enabled workspace per
call and is rejected unless the target service account is a member of
that workspace (it is implicitly a member of the default workspace).
Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite,
Terraform Cloud, Google) must constrain tenant identity via an
identity-bearing claim, a tenant-pinning subject prefix (such as
`repo:YOUR_ORG/...`), or a CEL condition referencing one of those
identity claims (e.g. `claims.repository_owner`). OAuth callers may only
manage rules whose `oauth_scope` is `workspace:developer` or
`workspace:inference`; other scopes require a Console session.

#### Parameters

- `issuerID: string`

  Tagged ID of the federation issuer.

- `match: FederationRuleMatch`

  Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.

- `name: string`

  Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

- `oauthScope: string`

  Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.

- `target: ServiceAccountTarget`

  Identity that tokens minted via this rule act as. Currently always a `service_account` target.

- `appliesToAllWorkspaces?: optional bool`

  When true, enable this rule for every workspace in the org (including workspaces created later).

- `description?: optional string`

  Optional free-text description.

- `tokenLifetimeSeconds?: optional int`

  Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

- `workspaceID?: optional string`

  Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.

#### Returns

- `class FederationRule`

  - `"federation_rule" type`

  - `string id`

    Tagged ID of the federation rule.

  - `bool appliesToAllWorkspaces`

    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.

  - `?\Datetime archivedAt`

    If set, this rule is archived and rejects token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.

  - `\Datetime createdAt`

    When this rule was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this rule.

  - `?string description`

    Optional free-text description.

  - `string issuerID`

    Tagged ID of the issuer whose tokens this rule accepts.

  - `?string issuerName`

    Issuer's display name at read time.

  - `FederationRuleMatch match`

    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

  - `string name`

    Admin-chosen slug identifier.

  - `string oauthScope`

    Space-separated OAuth scopes granted on the minted token.

  - `ServiceAccountTarget target`

    What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account.

  - `int tokenLifetimeSeconds`

    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

  - `\Datetime updatedAt`

    When this rule was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.

  - `list<string> workspaceIDs`

    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationRule = $client->organization->federation->rules->create(
  issuerID: 'issuer_id',
  match: [
    'audience' => 'audience',
    'claims' => ['foo' => 'string'],
    'condition' => 'condition',
    'subjectPrefix' => 'subject_prefix',
  ],
  name: 'x',
  oauthScope: 'x',
  target: [
    'serviceAccountID' => 'svac_01SDCCSbTxrXDpWc1phhtcfK',
    'type' => 'service_account',
    'serviceAccountName' => 'service_account_name',
  ],
  appliesToAllWorkspaces: true,
  description: 'description',
  tokenLifetimeSeconds: 60,
  workspaceID: 'workspace_id',
);

var_dump($federationRule);
```

##### Response (200)

```json
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}
```

### List Federation Rules

`$client->organization->federation->rules->list(?bool includeArchived, ?string issuerID, ?int limit, ?string page): PageCursor<FederationRule>`

**GET** `/v1/organizations/federation_rules`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

List federation rules in your organization.

Optionally filter by issuer with `issuer_id`. Archived rules are excluded
unless `include_archived=true`.

#### Parameters

- `includeArchived?: optional bool` (query parameter)

  Include archived resources. Defaults to false.

  default: false

- `issuerID?: optional string` (query parameter)

  Filter to rules referencing this federation issuer.

- `limit?: optional int` (query parameter)

  Number of results per page.

  default: 20

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class FederationRule`

  - `"federation_rule" type`

  - `string id`

    Tagged ID of the federation rule.

  - `bool appliesToAllWorkspaces`

    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.

  - `?\Datetime archivedAt`

    If set, this rule is archived and rejects token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.

  - `\Datetime createdAt`

    When this rule was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this rule.

  - `?string description`

    Optional free-text description.

  - `string issuerID`

    Tagged ID of the issuer whose tokens this rule accepts.

  - `?string issuerName`

    Issuer's display name at read time.

  - `FederationRuleMatch match`

    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

  - `string name`

    Admin-chosen slug identifier.

  - `string oauthScope`

    Space-separated OAuth scopes granted on the minted token.

  - `ServiceAccountTarget target`

    What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account.

  - `int tokenLifetimeSeconds`

    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

  - `\Datetime updatedAt`

    When this rule was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.

  - `list<string> workspaceIDs`

    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->federation->rules->list(
  includeArchived: true, issuerID: 'issuer_id', limit: 1, page: 'page'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
      "applies_to_all_workspaces": true,
      "archived_at": "2019-12-27T18:11:19.117Z",
      "archived_by_actor_id": "archived_by_actor_id",
      "attributes": {
        "foo": "string"
      },
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by_actor_id": "created_by_actor_id",
      "description": "description",
      "issuer_id": "issuer_id",
      "issuer_name": "issuer_name",
      "match": {
        "audience": "audience",
        "claims": {
          "foo": "string"
        },
        "condition": "condition",
        "subject_prefix": "subject_prefix"
      },
      "name": "prod-deploy-pipeline",
      "oauth_scope": "oauth_scope",
      "target": {
        "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
        "type": "service_account",
        "service_account_name": "service_account_name"
      },
      "token_lifetime_seconds": 0,
      "type": "federation_rule",
      "updated_at": "2024-10-30T23:58:27.427722Z",
      "updated_by_actor_id": "updated_by_actor_id",
      "workspace_id": "workspace_id",
      "workspace_ids": [
        "string"
      ]
    }
  ],
  "next_page": "next_page"
}
```

### Get Federation Rule

`$client->organization->federation->rules->retrieve(string federationRuleID): FederationRule`

**GET** `/v1/organizations/federation_rules/{federation_rule_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Retrieve a federation rule by its ID (`fdrl_...`).

#### Parameters

- `federationRuleID: string` (path parameter)

  ID of the federation rule.

#### Returns

- `class FederationRule`

  - `"federation_rule" type`

  - `string id`

    Tagged ID of the federation rule.

  - `bool appliesToAllWorkspaces`

    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.

  - `?\Datetime archivedAt`

    If set, this rule is archived and rejects token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.

  - `\Datetime createdAt`

    When this rule was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this rule.

  - `?string description`

    Optional free-text description.

  - `string issuerID`

    Tagged ID of the issuer whose tokens this rule accepts.

  - `?string issuerName`

    Issuer's display name at read time.

  - `FederationRuleMatch match`

    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

  - `string name`

    Admin-chosen slug identifier.

  - `string oauthScope`

    Space-separated OAuth scopes granted on the minted token.

  - `ServiceAccountTarget target`

    What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account.

  - `int tokenLifetimeSeconds`

    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

  - `\Datetime updatedAt`

    When this rule was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.

  - `list<string> workspaceIDs`

    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationRule = $client->organization->federation->rules->retrieve(
  'federation_rule_id'
);

var_dump($federationRule);
```

##### Response (200)

```json
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}
```

### Update Federation Rule

`$client->organization->federation->rules->update(string federationRuleID, ?bool appliesToAllWorkspaces, ?string description, ?FederationRuleMatch match, ?string name, ?string oauthScope, ?ServiceAccountTarget target, ?int tokenLifetimeSeconds, ?string workspaceID): FederationRule`

**POST** `/v1/organizations/federation_rules/{federation_rule_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Partially update a federation rule.

`issuer_id` is immutable. `match` and `target` are replaced as whole
objects when set. Referenced service accounts and workspaces must exist
in your organization; invalid references are rejected with a 400 error.
Archived rules cannot be updated; this returns 400. Create a new rule
instead. Rules on well-known shared issuers (GitHub Actions, GitLab,
Buildkite, Terraform Cloud, Google) must constrain tenant identity via
an identity-bearing claim, a tenant-pinning subject prefix (such as
`repo:YOUR_ORG/...`), or a CEL condition referencing one of those
identity claims (e.g. `claims.repository_owner`). On these issuers the
requirement is re-checked on every update; if an existing rule's stored
match does not yet constrain tenant identity, any update (even a rename
or description change) must also supply a conforming `match` in the same
request. OAuth callers may only manage rules whose `oauth_scope` is
`workspace:developer` or `workspace:inference`; other scopes require a
Console session.

#### Parameters

- `federationRuleID: string` (path parameter)

  ID of the federation rule to update.

- `appliesToAllWorkspaces?: optional bool`

  When true, enables this rule for every workspace in the org (including workspaces created later). Setting `false` is rejected with 400 if no workspace would remain enabled; a rule with only a legacy `workspace_id` binding continues to mint.

- `description?: optional string`

  Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).

- `match?: optional FederationRuleMatch`

  Replaces the entire match object. All populated matcher fields must pass.

- `name?: optional string`

  Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

- `oauthScope?: optional string`

  Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.

- `target?: optional ServiceAccountTarget`

  Replaces the entire target object. Currently always a `service_account` target.

- `tokenLifetimeSeconds?: optional int`

  Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

- `workspaceID?: optional string`

  Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead.

#### Returns

- `class FederationRule`

  - `"federation_rule" type`

  - `string id`

    Tagged ID of the federation rule.

  - `bool appliesToAllWorkspaces`

    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.

  - `?\Datetime archivedAt`

    If set, this rule is archived and rejects token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.

  - `\Datetime createdAt`

    When this rule was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this rule.

  - `?string description`

    Optional free-text description.

  - `string issuerID`

    Tagged ID of the issuer whose tokens this rule accepts.

  - `?string issuerName`

    Issuer's display name at read time.

  - `FederationRuleMatch match`

    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

  - `string name`

    Admin-chosen slug identifier.

  - `string oauthScope`

    Space-separated OAuth scopes granted on the minted token.

  - `ServiceAccountTarget target`

    What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account.

  - `int tokenLifetimeSeconds`

    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

  - `\Datetime updatedAt`

    When this rule was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.

  - `list<string> workspaceIDs`

    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationRule = $client->organization->federation->rules->update(
  'federation_rule_id',
  appliesToAllWorkspaces: true,
  description: 'description',
  match: [
    'audience' => 'audience',
    'claims' => ['foo' => 'string'],
    'condition' => 'condition',
    'subjectPrefix' => 'subject_prefix',
  ],
  name: 'x',
  oauthScope: 'x',
  target: [
    'serviceAccountID' => 'svac_01SDCCSbTxrXDpWc1phhtcfK',
    'type' => 'service_account',
    'serviceAccountName' => 'service_account_name',
  ],
  tokenLifetimeSeconds: 60,
  workspaceID: 'workspace_id',
);

var_dump($federationRule);
```

##### Response (200)

```json
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}
```

### Archive Federation Rule

`$client->organization->federation->rules->archive(string federationRuleID): FederationRule`

**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Archive a federation rule.

Token exchange through this rule stops immediately. Idempotent;
re-archiving returns the rule with its original `archived_at`. Archiving
clears the rule's workspace targeting (`workspace_id` and
`workspace_ids` are emptied). Tokens already minted before archive
remain valid until they expire. OAuth callers may only manage rules
whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
other scopes require a Console session.

#### Parameters

- `federationRuleID: string` (path parameter)

  ID of the federation rule to archive.

#### Returns

- `class FederationRule`

  - `"federation_rule" type`

  - `string id`

    Tagged ID of the federation rule.

  - `bool appliesToAllWorkspaces`

    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.

  - `?\Datetime archivedAt`

    If set, this rule is archived and rejects token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.

  - `\Datetime createdAt`

    When this rule was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this rule.

  - `?string description`

    Optional free-text description.

  - `string issuerID`

    Tagged ID of the issuer whose tokens this rule accepts.

  - `?string issuerName`

    Issuer's display name at read time.

  - `FederationRuleMatch match`

    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

  - `string name`

    Admin-chosen slug identifier.

  - `string oauthScope`

    Space-separated OAuth scopes granted on the minted token.

  - `ServiceAccountTarget target`

    What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account.

  - `int tokenLifetimeSeconds`

    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

  - `\Datetime updatedAt`

    When this rule was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.

  - `list<string> workspaceIDs`

    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationRule = $client->organization->federation->rules->archive(
  'federation_rule_id'
);

var_dump($federationRule);
```

##### Response (200)

```json
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}
```

## Organization › Federation › Rules › Workspaces

### Add Federation Rule Workspace

`$client->organization->federation->rules->workspaces->add(string federationRuleID, string workspaceID): FederationRuleWorkspace`

**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Enable a federation rule for a workspace.

Idempotent; re-enabling returns the existing enablement. The rule and
workspace must both belong to your organization. Membership of the
rule's target service account in this workspace is not checked at
enablement: token exchange into this workspace is rejected unless the
target is a member (it is implicitly a member of the default workspace).
Archived rules are rejected with 400. OAuth callers may only manage rules
whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
other scopes require a Console session.

#### Parameters

- `federationRuleID: string` (path parameter)

  ID of the federation rule.

- `workspaceID: string`

  Tagged ID of the workspace to enable this rule for.

#### Returns

- `class FederationRuleWorkspace`

  - `"federation_rule_workspace" type`

  - `\Datetime createdAt`

    When this workspace was enabled for the rule.

  - `?string createdByActorID`

    Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.

  - `string federationRuleID`

    Tagged ID of the federation rule.

  - `string workspaceID`

    Tagged ID of the workspace this rule is enabled for.

  - `?string workspaceName`

    Workspace display name. Populated when listing; null in the enable response.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationRuleWorkspace = $client
  ->organization
  ->federation
  ->rules
  ->workspaces
  ->add('federation_rule_id', workspaceID: 'workspace_id');

var_dump($federationRuleWorkspace);
```

##### Response (200)

```json
{
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "federation_rule_id": "federation_rule_id",
  "type": "federation_rule_workspace",
  "workspace_id": "workspace_id",
  "workspace_name": "workspace_name"
}
```

### List Federation Rule Workspaces

`$client->organization->federation->rules->workspaces->list(string federationRuleID, ?int limit, ?string page): PageCursor<FederationRuleWorkspace>`

**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

List workspaces where this federation rule is enabled.

Returns all workspace enablements in a single response; the `limit` and
`page` parameters are accepted but have no effect, and `next_page` is
always `null`. Returns explicit per-workspace enablements only; for
rules with `applies_to_all_workspaces` or a legacy single
`workspace_id`, check those fields on the rule itself.

#### Parameters

- `federationRuleID: string` (path parameter)

  ID of the federation rule.

- `limit?: optional int` (query parameter)

  Number of results per page.

  default: 20

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class FederationRuleWorkspace`

  - `"federation_rule_workspace" type`

  - `\Datetime createdAt`

    When this workspace was enabled for the rule.

  - `?string createdByActorID`

    Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.

  - `string federationRuleID`

    Tagged ID of the federation rule.

  - `string workspaceID`

    Tagged ID of the workspace this rule is enabled for.

  - `?string workspaceName`

    Workspace display name. Populated when listing; null in the enable response.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->federation->rules->workspaces->list(
  'federation_rule_id', limit: 1, page: 'page'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by_actor_id": "created_by_actor_id",
      "federation_rule_id": "federation_rule_id",
      "type": "federation_rule_workspace",
      "workspace_id": "workspace_id",
      "workspace_name": "workspace_name"
    }
  ],
  "next_page": "next_page"
}
```

### Remove Federation Rule Workspace

`$client->organization->federation->rules->workspaces->remove(string workspaceID, string federationRuleID): WorkspaceRemoveResponse`

**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Disable a federation rule for a workspace.

Idempotent; succeeds even if the enablement was already removed. OAuth
callers may only manage rules whose `oauth_scope` is
`workspace:developer` or `workspace:inference`; other scopes require a
Console session.

#### Parameters

- `federationRuleID: string` (path parameter)

  ID of the federation rule.

- `workspaceID: string` (path parameter)

  ID of the workspace to disable for.

#### Returns

- `class WorkspaceRemoveResponse`

  - `"federation_rule_workspace_deleted" type`

  - `string federationRuleID`

    Tagged ID of the federation rule.

  - `string workspaceID`

    Tagged ID of the workspace named in the delete request. Removal is idempotent.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspace = $client->organization->federation->rules->workspaces->remove(
  'workspace_id', federationRuleID: 'federation_rule_id'
);

var_dump($workspace);
```

##### Response (200)

```json
{
  "federation_rule_id": "federation_rule_id",
  "type": "federation_rule_workspace_deleted",
  "workspace_id": "workspace_id"
}
```

## Organization › Invites

### Create Invite

`$client->organization->invites->create(string email, Role role, ?list<string> rbacGroupIDs): OrganizationInvite`

**POST** `/v1/organizations/invites`

Invite a user to join the organization by email.

On plans that draw members from a finite pool of purchased seats, the invite automatically consumes a seat from the lowest tier with availability; there is no seat-tier parameter. When no seat is free the request fails with a 400 error rather than purchasing a seat.

#### Parameters

- `email: string`

  Email of the User.

- `role: Role`

  Role for the invited User.

  The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations accept `user` and `managed`; inviting with the `managed` role requires the `write:rbac_groups` scope in addition to `write:members`.

- `rbacGroupIDs?: optional list<string>`

  RBAC group IDs to assign to the User when the Invite is accepted. A non-empty array is accepted only for a Claude Enterprise organization with RBAC groups, and requires the key to carry the `write:rbac_groups` scope.

#### Returns

- `class OrganizationInvite`

  - `"invite" type`

    Object type.

    For Invites, this is always `"invite"`.

  - `string id`

    ID of the Invite.

  - `?\Datetime acceptedAt`

    RFC 3339 datetime string indicating when the Invite was accepted, or null.

  - `string email`

    Email of the User being invited.

  - `\Datetime expiresAt`

    RFC 3339 datetime string indicating when the Invite expires.

  - `\Datetime invitedAt`

    RFC 3339 datetime string indicating when the Invite was created.

  - `list<string> rbacGroupIDs`

    RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.

  - `OrganizationRole role`

    Organization role of the User.

  - `Status status`

    Status of the Invite.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$organizationInvite = $client->organization->invites->create(
  email: 'user@emaildomain.com', role: 'user', rbacGroupIDs: ['string']
);

var_dump($organizationInvite);
```

##### Response (200)

```json
{
  "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
  "accepted_at": "2019-12-27T18:11:19.117Z",
  "email": "user@emaildomain.com",
  "expires_at": "2024-11-20T23:58:27.427722Z",
  "invited_at": "2024-10-30T23:58:27.427722Z",
  "rbac_group_ids": [
    "string"
  ],
  "role": "admin",
  "status": "pending",
  "type": "invite"
}
```

### List Invites

`$client->organization->invites->list(?string afterID, ?string beforeID, ?string email, ?int limit, ?list<string> roles, ?list<Status> statuses): Page<OrganizationInvite>`

**GET** `/v1/organizations/invites`

List the organization's invites.

#### Parameters

- `afterID?: optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.

- `beforeID?: optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.

- `email?: optional string` (query parameter)

  Filter by the email address the Invite was sent to. Matches the same way as the Users list's `email` filter (normalized, case-insensitive).

- `limit?: optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

- `roles?: optional list<string>` (query parameter)

  Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together.

  Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`.

- `statuses?: optional list<Status>` (query parameter)

  Filter by Invite status. Repeatable; values are OR'ed together. Omit to return `pending`, `accepted`, and `expired` Invites alike.

#### Returns

- `class OrganizationInvite`

  - `"invite" type`

    Object type.

    For Invites, this is always `"invite"`.

  - `string id`

    ID of the Invite.

  - `?\Datetime acceptedAt`

    RFC 3339 datetime string indicating when the Invite was accepted, or null.

  - `string email`

    Email of the User being invited.

  - `\Datetime expiresAt`

    RFC 3339 datetime string indicating when the Invite expires.

  - `\Datetime invitedAt`

    RFC 3339 datetime string indicating when the Invite was created.

  - `list<string> rbacGroupIDs`

    RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.

  - `OrganizationRole role`

    Organization role of the User.

  - `Status status`

    Status of the Invite.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->invites->list(
  afterID: 'after_id',
  beforeID: 'before_id',
  email: 'dev@stainless.com',
  limit: 1,
  roles: ['string'],
  statuses: ['accepted'],
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
      "accepted_at": "2019-12-27T18:11:19.117Z",
      "email": "user@emaildomain.com",
      "expires_at": "2024-11-20T23:58:27.427722Z",
      "invited_at": "2024-10-30T23:58:27.427722Z",
      "rbac_group_ids": [
        "string"
      ],
      "role": "admin",
      "status": "pending",
      "type": "invite"
    }
  ],
  "first_id": "first_id",
  "has_more": true,
  "last_id": "last_id"
}
```

### Get Invite

`$client->organization->invites->retrieve(string inviteID): OrganizationInvite`

**GET** `/v1/organizations/invites/{invite_id}`

Retrieve an invite by ID.

#### Parameters

- `inviteID: string` (path parameter)

  ID of the Invite.

#### Returns

- `class OrganizationInvite`

  - `"invite" type`

    Object type.

    For Invites, this is always `"invite"`.

  - `string id`

    ID of the Invite.

  - `?\Datetime acceptedAt`

    RFC 3339 datetime string indicating when the Invite was accepted, or null.

  - `string email`

    Email of the User being invited.

  - `\Datetime expiresAt`

    RFC 3339 datetime string indicating when the Invite expires.

  - `\Datetime invitedAt`

    RFC 3339 datetime string indicating when the Invite was created.

  - `list<string> rbacGroupIDs`

    RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.

  - `OrganizationRole role`

    Organization role of the User.

  - `Status status`

    Status of the Invite.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$organizationInvite = $client->organization->invites->retrieve('invite_id');

var_dump($organizationInvite);
```

##### Response (200)

```json
{
  "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
  "accepted_at": "2019-12-27T18:11:19.117Z",
  "email": "user@emaildomain.com",
  "expires_at": "2024-11-20T23:58:27.427722Z",
  "invited_at": "2024-10-30T23:58:27.427722Z",
  "rbac_group_ids": [
    "string"
  ],
  "role": "admin",
  "status": "pending",
  "type": "invite"
}
```

### Delete Invite

`$client->organization->invites->delete(string inviteID): InviteDeleteResponse`

**DELETE** `/v1/organizations/invites/{invite_id}`

Delete a pending invite.

#### Parameters

- `inviteID: string` (path parameter)

  ID of the Invite.

#### Returns

- `class InviteDeleteResponse`

  - `"invite_deleted" type`

    Deleted object type.

    For Invites, this is always `"invite_deleted"`.

  - `string id`

    ID of the Invite.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$invite = $client->organization->invites->delete('invite_id');

var_dump($invite);
```

##### Response (200)

```json
{
  "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
  "type": "invite_deleted"
}
```

## Organization › Service Accounts

### Create Service Account

`$client->organization->serviceAccounts->create(string name, ?string description, ?OrganizationRole organizationRole): ServiceAccount`

**POST** `/v1/organizations/service_accounts`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Create a service account.

A service account is a named workload identity that federation rules
target. `organization_role` is `developer` (default) or `admin`; a rule
may only be created or retargeted to grant `org:admin` scope when the
target's `organization_role` is `admin`. Creating an `admin`-role service
account requires an interactive credential (a user OAuth token or a
Console session) — a workload may only create `developer`-role service
accounts.

#### Parameters

- `name: string`

  Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

- `description?: optional string`

  Optional free-text description.

- `organizationRole?: optional OrganizationRole`

  Org-level role. Defaults to `developer`.

#### Returns

- `class ServiceAccount`

  - `"service_account" type`

  - `string id`

    Tagged ID of the service account.

  - `?\Datetime archivedAt`

    If set, this service account is archived.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.

  - `\Datetime createdAt`

    When this service account was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this service account.

  - `?string description`

    Optional free-text description.

  - `string name`

    Admin-chosen slug identifier.

  - `OrganizationRole organizationRole`

    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.

  - `\Datetime updatedAt`

    When this service account was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccount = $client->organization->serviceAccounts->create(
  name: 'ci-deploy-bot', description: 'description', organizationRole: 'admin'
);

var_dump($serviceAccount);
```

##### Response (200)

```json
{
  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "name": "ci-deploy-bot",
  "organization_role": "admin",
  "type": "service_account",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

### List Service Accounts

`$client->organization->serviceAccounts->list(?bool includeArchived, ?int limit, ?string page): PageCursor<ServiceAccount>`

**GET** `/v1/organizations/service_accounts`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

List service accounts in the caller's organization.

Results are ordered by creation time, newest first. Use `limit` and the
`next_page` cursor to paginate; set `include_archived=true` to include
archived service accounts.

#### Parameters

- `includeArchived?: optional bool` (query parameter)

  Include archived resources. Defaults to false.

  default: false

- `limit?: optional int` (query parameter)

  Number of results per page.

  default: 20

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class ServiceAccount`

  - `"service_account" type`

  - `string id`

    Tagged ID of the service account.

  - `?\Datetime archivedAt`

    If set, this service account is archived.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.

  - `\Datetime createdAt`

    When this service account was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this service account.

  - `?string description`

    Optional free-text description.

  - `string name`

    Admin-chosen slug identifier.

  - `OrganizationRole organizationRole`

    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.

  - `\Datetime updatedAt`

    When this service account was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->serviceAccounts->list(
  includeArchived: true, limit: 1, page: 'page'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
      "archived_at": "2019-12-27T18:11:19.117Z",
      "archived_by_actor_id": "archived_by_actor_id",
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by_actor_id": "created_by_actor_id",
      "description": "description",
      "name": "ci-deploy-bot",
      "organization_role": "admin",
      "type": "service_account",
      "updated_at": "2024-10-30T23:58:27.427722Z",
      "updated_by_actor_id": "updated_by_actor_id"
    }
  ],
  "next_page": "next_page"
}
```

### Get Service Account

`$client->organization->serviceAccounts->retrieve(string serviceAccountID): ServiceAccount`

**GET** `/v1/organizations/service_accounts/{service_account_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Retrieve a service account by its ID (`svac_...`).

#### Parameters

- `serviceAccountID: string` (path parameter)

  ID of the service account.

#### Returns

- `class ServiceAccount`

  - `"service_account" type`

  - `string id`

    Tagged ID of the service account.

  - `?\Datetime archivedAt`

    If set, this service account is archived.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.

  - `\Datetime createdAt`

    When this service account was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this service account.

  - `?string description`

    Optional free-text description.

  - `string name`

    Admin-chosen slug identifier.

  - `OrganizationRole organizationRole`

    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.

  - `\Datetime updatedAt`

    When this service account was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccount = $client->organization->serviceAccounts->retrieve(
  'service_account_id'
);

var_dump($serviceAccount);
```

##### Response (200)

```json
{
  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "name": "ci-deploy-bot",
  "organization_role": "admin",
  "type": "service_account",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

### Update Service Account

`$client->organization->serviceAccounts->update(string serviceAccountID, ?string description, ?OrganizationRole organizationRole): ServiceAccount`

**POST** `/v1/organizations/service_accounts/{service_account_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Update a service account.

Only `description` and `organization_role` are mutable; `name` cannot be
changed. Archived service accounts cannot be updated; this returns 400.
Setting `organization_role` to `admin` (even when unchanged) requires an
interactive credential (a user OAuth token or a Console session).

#### Parameters

- `serviceAccountID: string` (path parameter)

  ID of the service account to update.

- `description?: optional string`

  Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).

- `organizationRole?: optional OrganizationRole`

  Replaces the org-level role. Omit or send `null` to leave unchanged.

#### Returns

- `class ServiceAccount`

  - `"service_account" type`

  - `string id`

    Tagged ID of the service account.

  - `?\Datetime archivedAt`

    If set, this service account is archived.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.

  - `\Datetime createdAt`

    When this service account was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this service account.

  - `?string description`

    Optional free-text description.

  - `string name`

    Admin-chosen slug identifier.

  - `OrganizationRole organizationRole`

    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.

  - `\Datetime updatedAt`

    When this service account was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccount = $client->organization->serviceAccounts->update(
  'service_account_id', description: 'description', organizationRole: 'admin'
);

var_dump($serviceAccount);
```

##### Response (200)

```json
{
  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "name": "ci-deploy-bot",
  "organization_role": "admin",
  "type": "service_account",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

### Archive Service Account

`$client->organization->serviceAccounts->archive(string serviceAccountID): ServiceAccount`

**POST** `/v1/organizations/service_accounts/{service_account_id}/archive`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Archive a service account.

Idempotent; re-archiving returns the service account with its original
`archived_at`. Rejected with 400 if any live (non-archived) federation
rule still targets this service account, same as issuer archival; archive
those rules first or change their target to another service account.

#### Parameters

- `serviceAccountID: string` (path parameter)

  ID of the service account to archive.

#### Returns

- `class ServiceAccount`

  - `"service_account" type`

  - `string id`

    Tagged ID of the service account.

  - `?\Datetime archivedAt`

    If set, this service account is archived.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.

  - `\Datetime createdAt`

    When this service account was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this service account.

  - `?string description`

    Optional free-text description.

  - `string name`

    Admin-chosen slug identifier.

  - `OrganizationRole organizationRole`

    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.

  - `\Datetime updatedAt`

    When this service account was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccount = $client->organization->serviceAccounts->archive(
  'service_account_id'
);

var_dump($serviceAccount);
```

##### Response (200)

```json
{
  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "name": "ci-deploy-bot",
  "organization_role": "admin",
  "type": "service_account",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

## Organization › Service Accounts › Workspaces

### Add Workspace To Service Account

`$client->organization->serviceAccounts->workspaces->add(string serviceAccountID, string workspaceID, NoBillingWorkspaceRole workspaceRole): ServiceAccountWorkspaceMember`

**POST** `/v1/organizations/service_accounts/{service_account_id}/workspaces`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Add a service account to a workspace with the given `workspace_role`.

Mirror of `POST /workspaces/{workspace_id}/service_accounts`, addressed
from the service-account side; both create the same membership. If the
service account is already an explicit member of the workspace, its
`workspace_role` is replaced with the value supplied here. Archived
workspaces return 400. Archived service accounts cannot be added and are
rejected.

#### Parameters

- `serviceAccountID: string` (path parameter)

  ID of the service account.

- `workspaceID: string`

  Tagged workspace ID to add the service account to.

- `workspaceRole: NoBillingWorkspaceRole`

  Role to assign to the service account in this workspace.

#### Returns

- `class ServiceAccountWorkspaceMember`

  - `"service_account_workspace_member" type`

  - `?string createdByActorID`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `?bool implicit`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`).

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole workspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Workspaces\NoBillingWorkspaceRole;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccountWorkspaceMember = $client
  ->organization
  ->serviceAccounts
  ->workspaces
  ->add(
  'service_account_id',
  workspaceID: 'workspace_id',
  workspaceRole: NoBillingWorkspaceRole::WORKSPACE_ADMIN,
);

var_dump($serviceAccountWorkspaceMember);
```

##### Response (200)

```json
{
  "created_by_actor_id": "created_by_actor_id",
  "implicit": true,
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member",
  "workspace_id": "workspace_id",
  "workspace_role": "workspace_admin"
}
```

### List Workspaces For Service Account

`$client->organization->serviceAccounts->workspaces->list(string serviceAccountID, ?int limit, ?string page): PageCursor<ServiceAccountWorkspaceMember>`

**GET** `/v1/organizations/service_accounts/{service_account_id}/workspaces`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

List the workspaces a service account is a member of.

Each entry includes the service account's `workspace_role` in that
workspace. Use `limit` and the `next_page` cursor to paginate. When the
service account has no explicit default-workspace membership, the
implicit (`implicit: true`) membership is returned as the first entry on
the first page; with `limit=1` the first page may return up to 2 entries
(the implicit entry plus one explicit membership) so a pagination cursor
can be derived. Memberships are returned only while
the service account is active. Without a `page` cursor, an archived
service account returns an empty list. A `page` cursor that does not
match an active membership returns a 400 invalid-request error. A cursor
stops matching when the membership is removed, the workspace is deleted,
or the service account is archived. Restart pagination from the first
page to recover.

#### Parameters

- `serviceAccountID: string` (path parameter)

  ID of the service account.

- `limit?: optional int` (query parameter)

  Number of results per page.

  default: 20

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class ServiceAccountWorkspaceMember`

  - `"service_account_workspace_member" type`

  - `?string createdByActorID`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `?bool implicit`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`).

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole workspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->serviceAccounts->workspaces->list(
  'service_account_id', limit: 1, page: 'page'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "created_by_actor_id": "created_by_actor_id",
      "implicit": true,
      "service_account_id": "service_account_id",
      "type": "service_account_workspace_member",
      "workspace_id": "workspace_id",
      "workspace_role": "workspace_admin"
    }
  ],
  "next_page": "next_page"
}
```

### Remove Workspace From Service Account

`$client->organization->serviceAccounts->workspaces->remove(string workspaceID, string serviceAccountID): WorkspaceRemoveResponse`

**DELETE** `/v1/organizations/service_accounts/{service_account_id}/workspaces/{workspace_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Remove a service account from a workspace.

Mirror of `DELETE /workspaces/{workspace_id}/service_accounts/{service_account_id}`,
addressed from the service-account side. Removal is idempotent (returns
200 even if the membership was already removed). A DELETE against the
implicit default-workspace membership returns 200 but is a no-op and the
membership persists; deleting an explicit default-workspace row reverts
to the implicit `workspace_user` membership. Archived workspaces return
400.

#### Parameters

- `serviceAccountID: string` (path parameter)

  ID of the service account.

- `workspaceID: string` (path parameter)

  ID of the workspace.

#### Returns

- `class WorkspaceRemoveResponse`

  - `"service_account_workspace_member_deleted" type`

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op.

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`) named in the delete request.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspace = $client->organization->serviceAccounts->workspaces->remove(
  'workspace_id', serviceAccountID: 'service_account_id'
);

var_dump($workspace);
```

##### Response (200)

```json
{
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member_deleted",
  "workspace_id": "workspace_id"
}
```

## Organization › Users

### List Users

`$client->organization->users->list(?string afterID, ?string beforeID, ?string email, ?int limit, ?list<string> roles): Page<OrganizationUser>`

**GET** `/v1/organizations/users`

List the organization's members.

#### Parameters

- `afterID?: optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.

- `beforeID?: optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.

- `email?: optional string` (query parameter)

  Filter by user email.

- `limit?: optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

- `roles?: optional list<string>` (query parameter)

  Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together.

  Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`.

#### Returns

- `class OrganizationUser`

  - `"user" type`

    Object type.

    For Users, this is always `"user"`.

  - `string id`

    ID of the User.

  - `\Datetime addedAt`

    RFC 3339 datetime string indicating when the User joined the Organization.

  - `string email`

    Email of the User.

  - `string name`

    Name of the User.

  - `OrganizationRole role`

    Organization role of the User.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->users->list(
  afterID: 'after_id',
  beforeID: 'before_id',
  email: 'dev@stainless.com',
  limit: 1,
  roles: ['string'],
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
      "added_at": "2024-10-30T23:58:27.427722Z",
      "email": "user@emaildomain.com",
      "name": "Jane Doe",
      "role": "admin",
      "type": "user"
    }
  ],
  "first_id": "first_id",
  "has_more": true,
  "last_id": "last_id"
}
```

### Get User

`$client->organization->users->retrieve(string userID): OrganizationUser`

**GET** `/v1/organizations/users/{user_id}`

Retrieve a member of the organization by user ID.

#### Parameters

- `userID: string` (path parameter)

  ID of the User.

#### Returns

- `class OrganizationUser`

  - `"user" type`

    Object type.

    For Users, this is always `"user"`.

  - `string id`

    ID of the User.

  - `\Datetime addedAt`

    RFC 3339 datetime string indicating when the User joined the Organization.

  - `string email`

    Email of the User.

  - `string name`

    Name of the User.

  - `OrganizationRole role`

    Organization role of the User.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$organizationUser = $client->organization->users->retrieve('user_id');

var_dump($organizationUser);
```

##### Response (200)

```json
{
  "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
  "added_at": "2024-10-30T23:58:27.427722Z",
  "email": "user@emaildomain.com",
  "name": "Jane Doe",
  "role": "admin",
  "type": "user"
}
```

### Update User

`$client->organization->users->update(string userID, Role role): OrganizationUser`

**POST** `/v1/organizations/users/{user_id}`

Update a member's organization role.

#### Parameters

- `userID: string` (path parameter)

  ID of the User.

- `role: Role`

  New role for the User.

  The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations accept `user` and `managed`; changing a User's role to `managed` requires the `write:rbac_groups` scope in addition to `write:members`.

#### Returns

- `class OrganizationUser`

  - `"user" type`

    Object type.

    For Users, this is always `"user"`.

  - `string id`

    ID of the User.

  - `\Datetime addedAt`

    RFC 3339 datetime string indicating when the User joined the Organization.

  - `string email`

    Email of the User.

  - `string name`

    Name of the User.

  - `OrganizationRole role`

    Organization role of the User.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$organizationUser = $client->organization->users->update(
  'user_id', role: 'user'
);

var_dump($organizationUser);
```

##### Response (200)

```json
{
  "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
  "added_at": "2024-10-30T23:58:27.427722Z",
  "email": "user@emaildomain.com",
  "name": "Jane Doe",
  "role": "admin",
  "type": "user"
}
```

### Remove User

`$client->organization->users->remove(string userID): UserRemoveResponse`

**DELETE** `/v1/organizations/users/{user_id}`

Remove a member from the organization.

#### Parameters

- `userID: string` (path parameter)

  ID of the User.

#### Returns

- `class UserRemoveResponse`

  - `"user_deleted" type`

    Deleted object type.

    For Users, this is always `"user_deleted"`.

  - `string id`

    ID of the User.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$user = $client->organization->users->remove('user_id');

var_dump($user);
```

##### Response (200)

```json
{
  "id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
  "type": "user_deleted"
}
```

## Organization › Workspaces

### List Workspaces

`$client->organization->workspaces->list(?string afterID, ?string beforeID, ?bool includeArchived, ?bool includeDefault, ?int limit): Page<Workspace>`

**GET** `/v1/organizations/workspaces`

List Workspaces

#### Parameters

- `afterID?: optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.

- `beforeID?: optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.

- `includeArchived?: optional bool` (query parameter)

  Whether to include Workspaces that have been archived in the response

  default: false

- `includeDefault?: optional bool` (query parameter)

  Whether to include the organization's default Workspace in the response

  default: false

- `limit?: optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

#### Returns

- `class Workspace`

  - `"workspace" type`

    Object type.

    For Workspaces, this is always `"workspace"`.

  - `string id`

    ID of the Workspace.

  - `?\Datetime archivedAt`

    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.

  - `string compartmentID`

    Identifier for this Workspace's encryption compartment. When you configure an
    AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
    profile, reference this value in your KMS key-policy condition so the key is
    scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
    binding automatically; you do not need to reference this value in your key
    configuration. See the CMEK integration guide for the required key
    configuration; unless your organization is on Claude Platform on AWS, it
    includes a separate value used during key validation. On Claude Platform on AWS
    there is no separate validation value: your organization's own key is validated
    against this Workspace's own value when it is attached, so if its key policy
    uses the compartment condition, add this value to it before attaching the key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the Workspace was created.

  - `DataResidency dataResidency`

    Data residency configuration.

  - `string displayColor`

    Hex color code representing the Workspace in the Anthropic Console.

  - `?string externalKeyID`

    ID of the customer-managed encryption key (CMEK) configuration to use for this
    Workspace. Setting this field requires CMEK to be enabled for your
    organization. When set, data stored for this Workspace is encrypted with the
    referenced key. Create key configurations with the External Keys API. On
    Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
    organization's own key must be a single-Region key in the same AWS account and
    Region as the Workspace. On that platform the key is validated against this
    Workspace when it is attached, so a key-policy problem is reported as an error
    on this request. This field is write-once: once a key is attached to a Workspace
    it cannot be detached or replaced. To rotate key material, rotate the underlying
    key on your cloud KMS; the `external_key_id` stays the same.

  - `string name`

    Name of the Workspace.

  - `array<string,string> tags`

    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.

  - `?string userProfileID`

    ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->workspaces->list(
  afterID: 'after_id',
  beforeID: 'before_id',
  includeArchived: true,
  includeDefault: true,
  limit: 1,
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
      "archived_at": "2024-11-01T23:59:27.427722Z",
      "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",
      "created_at": "2024-10-30T23:58:27.427722Z",
      "data_residency": {
        "allowed_inference_geos": "unrestricted",
        "default_inference_geo": "global",
        "workspace_geo": "us"
      },
      "display_color": "#6C5BB9",
      "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
      "name": "Workspace Name",
      "tags": {
        "env": "prod",
        "team": "platform"
      },
      "type": "workspace",
      "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
    }
  ],
  "first_id": "first_id",
  "has_more": true,
  "last_id": "last_id"
}
```

### Create Workspace

`$client->organization->workspaces->create(string name, ?DataResidencyCreateConfig dataResidency, ?string displayColor, ?string externalKeyID, ?array<string,string> tags, ?string userProfileID): Workspace`

**POST** `/v1/organizations/workspaces`

Create Workspace

#### Parameters

- `name: string`

  Name of the Workspace.

- `dataResidency?: optional DataResidencyCreateConfig`

  Data residency configuration for the workspace. If omitted, defaults to `workspace_geo: "us"`, `allowed_inference_geos: "unrestricted"`, and `default_inference_geo: "global"`.

- `displayColor?: optional string`

  Hex color code representing the Workspace in the Anthropic Console.

- `externalKeyID?: optional string`

  ID of the customer-managed encryption key (CMEK) configuration to use for this
  Workspace. Setting this field requires CMEK to be enabled for your
  organization. When set, data stored for this Workspace is encrypted with the
  referenced key. Create key configurations with the External Keys API. On
  Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
  organization's own key must be a single-Region key in the same AWS account and
  Region as the Workspace. On that platform the key is validated against this
  Workspace when it is attached, so a key-policy problem is reported as an error
  on this request. This field is write-once: once a key is attached to a Workspace
  it cannot be detached or replaced. To rotate key material, rotate the underlying
  key on your cloud KMS; the `external_key_id` stays the same.

- `tags?: optional array<string,string>`

  User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.

- `userProfileID?: optional string`

  ID of a user profile to attach to the Workspace. Every inference request through the Workspace must then name this user profile; the API rejects a request that names none or a different one. The user profile can't be replaced or removed later; only deleting the user profile clears it.

#### Returns

- `class Workspace`

  - `"workspace" type`

    Object type.

    For Workspaces, this is always `"workspace"`.

  - `string id`

    ID of the Workspace.

  - `?\Datetime archivedAt`

    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.

  - `string compartmentID`

    Identifier for this Workspace's encryption compartment. When you configure an
    AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
    profile, reference this value in your KMS key-policy condition so the key is
    scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
    binding automatically; you do not need to reference this value in your key
    configuration. See the CMEK integration guide for the required key
    configuration; unless your organization is on Claude Platform on AWS, it
    includes a separate value used during key validation. On Claude Platform on AWS
    there is no separate validation value: your organization's own key is validated
    against this Workspace's own value when it is attached, so if its key policy
    uses the compartment condition, add this value to it before attaching the key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the Workspace was created.

  - `DataResidency dataResidency`

    Data residency configuration.

  - `string displayColor`

    Hex color code representing the Workspace in the Anthropic Console.

  - `?string externalKeyID`

    ID of the customer-managed encryption key (CMEK) configuration to use for this
    Workspace. Setting this field requires CMEK to be enabled for your
    organization. When set, data stored for this Workspace is encrypted with the
    referenced key. Create key configurations with the External Keys API. On
    Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
    organization's own key must be a single-Region key in the same AWS account and
    Region as the Workspace. On that platform the key is validated against this
    Workspace when it is attached, so a key-policy problem is reported as an error
    on this request. This field is write-once: once a key is attached to a Workspace
    it cannot be detached or replaced. To rotate key material, rotate the underlying
    key on your cloud KMS; the `external_key_id` stays the same.

  - `string name`

    Name of the Workspace.

  - `array<string,string> tags`

    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.

  - `?string userProfileID`

    ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspace = $client->organization->workspaces->create(
  name: 'x',
  dataResidency: [
    'allowedInferenceGeos' => 'unrestricted',
    'defaultInferenceGeo' => 'global',
    'workspaceGeo' => 'us',
  ],
  displayColor: '#6C5BB9',
  externalKeyID: 'ekey_01SDCCSbTxrXDpWc1phhtcfK',
  tags: ['env' => 'prod', 'team' => 'platform'],
  userProfileID: 'uprof_01SDCCSbTxrXDpWc1phhtcfK',
);

var_dump($workspace);
```

##### Response (200)

```json
{
  "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
  "archived_at": "2024-11-01T23:59:27.427722Z",
  "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "data_residency": {
    "allowed_inference_geos": "unrestricted",
    "default_inference_geo": "global",
    "workspace_geo": "us"
  },
  "display_color": "#6C5BB9",
  "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "name": "Workspace Name",
  "tags": {
    "env": "prod",
    "team": "platform"
  },
  "type": "workspace",
  "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
}
```

### Get Workspace

`$client->organization->workspaces->retrieve(string workspaceID): Workspace`

**GET** `/v1/organizations/workspaces/{workspace_id}`

Get Workspace

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the Workspace.

#### Returns

- `class Workspace`

  - `"workspace" type`

    Object type.

    For Workspaces, this is always `"workspace"`.

  - `string id`

    ID of the Workspace.

  - `?\Datetime archivedAt`

    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.

  - `string compartmentID`

    Identifier for this Workspace's encryption compartment. When you configure an
    AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
    profile, reference this value in your KMS key-policy condition so the key is
    scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
    binding automatically; you do not need to reference this value in your key
    configuration. See the CMEK integration guide for the required key
    configuration; unless your organization is on Claude Platform on AWS, it
    includes a separate value used during key validation. On Claude Platform on AWS
    there is no separate validation value: your organization's own key is validated
    against this Workspace's own value when it is attached, so if its key policy
    uses the compartment condition, add this value to it before attaching the key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the Workspace was created.

  - `DataResidency dataResidency`

    Data residency configuration.

  - `string displayColor`

    Hex color code representing the Workspace in the Anthropic Console.

  - `?string externalKeyID`

    ID of the customer-managed encryption key (CMEK) configuration to use for this
    Workspace. Setting this field requires CMEK to be enabled for your
    organization. When set, data stored for this Workspace is encrypted with the
    referenced key. Create key configurations with the External Keys API. On
    Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
    organization's own key must be a single-Region key in the same AWS account and
    Region as the Workspace. On that platform the key is validated against this
    Workspace when it is attached, so a key-policy problem is reported as an error
    on this request. This field is write-once: once a key is attached to a Workspace
    it cannot be detached or replaced. To rotate key material, rotate the underlying
    key on your cloud KMS; the `external_key_id` stays the same.

  - `string name`

    Name of the Workspace.

  - `array<string,string> tags`

    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.

  - `?string userProfileID`

    ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspace = $client->organization->workspaces->retrieve('workspace_id');

var_dump($workspace);
```

##### Response (200)

```json
{
  "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
  "archived_at": "2024-11-01T23:59:27.427722Z",
  "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "data_residency": {
    "allowed_inference_geos": "unrestricted",
    "default_inference_geo": "global",
    "workspace_geo": "us"
  },
  "display_color": "#6C5BB9",
  "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "name": "Workspace Name",
  "tags": {
    "env": "prod",
    "team": "platform"
  },
  "type": "workspace",
  "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
}
```

### Update Workspace

`$client->organization->workspaces->update(string workspaceID, ?DataResidencyUpdateConfig dataResidency, ?string displayColor, ?string externalKeyID, ?string name, ?array<string,string> tags, ?string userProfileID): Workspace`

**POST** `/v1/organizations/workspaces/{workspace_id}`

Update Workspace

#### Parameters

- `workspaceID: string` (path parameter)

- `dataResidency?: optional DataResidencyUpdateConfig`

  Data residency configuration for the workspace.

- `displayColor?: optional string`

  Hex color code representing the Workspace in the Anthropic Console.

- `externalKeyID?: optional string`

  ID of the customer-managed encryption key (CMEK) configuration to use for this
  Workspace. Setting this field requires CMEK to be enabled for your
  organization. When set, data stored for this Workspace is encrypted with the
  referenced key. Create key configurations with the External Keys API. On
  Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
  organization's own key must be a single-Region key in the same AWS account and
  Region as the Workspace. On that platform the key is validated against this
  Workspace when it is attached, so a key-policy problem is reported as an error
  on this request. This field is write-once: once a key is attached to a Workspace
  it cannot be detached or replaced. To rotate key material, rotate the underlying
  key on your cloud KMS; the `external_key_id` stays the same.

- `name?: optional string`

  Name of the Workspace.

- `tags?: optional array<string,string>`

  User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.

- `userProfileID?: optional string`

  ID of a user profile to attach to the Workspace. Every inference request through the Workspace must then name this user profile; the API rejects a request that names none or a different one. Once set, it can't be replaced or removed (sending the same ID again changes nothing); only deleting the user profile clears it. The default Workspace can't have a user profile.

#### Returns

- `class Workspace`

  - `"workspace" type`

    Object type.

    For Workspaces, this is always `"workspace"`.

  - `string id`

    ID of the Workspace.

  - `?\Datetime archivedAt`

    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.

  - `string compartmentID`

    Identifier for this Workspace's encryption compartment. When you configure an
    AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
    profile, reference this value in your KMS key-policy condition so the key is
    scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
    binding automatically; you do not need to reference this value in your key
    configuration. See the CMEK integration guide for the required key
    configuration; unless your organization is on Claude Platform on AWS, it
    includes a separate value used during key validation. On Claude Platform on AWS
    there is no separate validation value: your organization's own key is validated
    against this Workspace's own value when it is attached, so if its key policy
    uses the compartment condition, add this value to it before attaching the key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the Workspace was created.

  - `DataResidency dataResidency`

    Data residency configuration.

  - `string displayColor`

    Hex color code representing the Workspace in the Anthropic Console.

  - `?string externalKeyID`

    ID of the customer-managed encryption key (CMEK) configuration to use for this
    Workspace. Setting this field requires CMEK to be enabled for your
    organization. When set, data stored for this Workspace is encrypted with the
    referenced key. Create key configurations with the External Keys API. On
    Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
    organization's own key must be a single-Region key in the same AWS account and
    Region as the Workspace. On that platform the key is validated against this
    Workspace when it is attached, so a key-policy problem is reported as an error
    on this request. This field is write-once: once a key is attached to a Workspace
    it cannot be detached or replaced. To rotate key material, rotate the underlying
    key on your cloud KMS; the `external_key_id` stays the same.

  - `string name`

    Name of the Workspace.

  - `array<string,string> tags`

    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.

  - `?string userProfileID`

    ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspace = $client->organization->workspaces->update(
  'workspace_id',
  dataResidency: [
    'allowedInferenceGeos' => 'unrestricted', 'defaultInferenceGeo' => 'global'
  ],
  displayColor: '#6C5BB9',
  externalKeyID: 'ekey_01SDCCSbTxrXDpWc1phhtcfK',
  name: 'x',
  tags: ['env' => 'prod', 'team' => 'platform'],
  userProfileID: 'uprof_01SDCCSbTxrXDpWc1phhtcfK',
);

var_dump($workspace);
```

##### Response (200)

```json
{
  "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
  "archived_at": "2024-11-01T23:59:27.427722Z",
  "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "data_residency": {
    "allowed_inference_geos": "unrestricted",
    "default_inference_geo": "global",
    "workspace_geo": "us"
  },
  "display_color": "#6C5BB9",
  "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "name": "Workspace Name",
  "tags": {
    "env": "prod",
    "team": "platform"
  },
  "type": "workspace",
  "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
}
```

### Archive Workspace

`$client->organization->workspaces->archive(string workspaceID): Workspace`

**POST** `/v1/organizations/workspaces/{workspace_id}/archive`

Archive Workspace

#### Parameters

- `workspaceID: string` (path parameter)

#### Returns

- `class Workspace`

  - `"workspace" type`

    Object type.

    For Workspaces, this is always `"workspace"`.

  - `string id`

    ID of the Workspace.

  - `?\Datetime archivedAt`

    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.

  - `string compartmentID`

    Identifier for this Workspace's encryption compartment. When you configure an
    AWS KMS customer-managed encryption key (CMEK) that isn't bound to a user
    profile, reference this value in your KMS key-policy condition so the key is
    scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment
    binding automatically; you do not need to reference this value in your key
    configuration. See the CMEK integration guide for the required key
    configuration; unless your organization is on Claude Platform on AWS, it
    includes a separate value used during key validation. On Claude Platform on AWS
    there is no separate validation value: your organization's own key is validated
    against this Workspace's own value when it is attached, so if its key policy
    uses the compartment condition, add this value to it before attaching the key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the Workspace was created.

  - `DataResidency dataResidency`

    Data residency configuration.

  - `string displayColor`

    Hex color code representing the Workspace in the Anthropic Console.

  - `?string externalKeyID`

    ID of the customer-managed encryption key (CMEK) configuration to use for this
    Workspace. Setting this field requires CMEK to be enabled for your
    organization. When set, data stored for this Workspace is encrypted with the
    referenced key. Create key configurations with the External Keys API. On
    Claude Platform on AWS the value for an AWS KMS key is the key's ARN, and your
    organization's own key must be a single-Region key in the same AWS account and
    Region as the Workspace. On that platform the key is validated against this
    Workspace when it is attached, so a key-policy problem is reported as an error
    on this request. This field is write-once: once a key is attached to a Workspace
    it cannot be detached or replaced. To rotate key material, rotate the underlying
    key on your cloud KMS; the `external_key_id` stays the same.

  - `string name`

    Name of the Workspace.

  - `array<string,string> tags`

    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.

  - `?string userProfileID`

    ID of the user profile attached to the Workspace, or null if it has none. Every inference request through a Workspace that has a user profile must name that profile.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspace = $client->organization->workspaces->archive('workspace_id');

var_dump($workspace);
```

##### Response (200)

```json
{
  "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
  "archived_at": "2024-11-01T23:59:27.427722Z",
  "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "data_residency": {
    "allowed_inference_geos": "unrestricted",
    "default_inference_geo": "global",
    "workspace_geo": "us"
  },
  "display_color": "#6C5BB9",
  "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "name": "Workspace Name",
  "tags": {
    "env": "prod",
    "team": "platform"
  },
  "type": "workspace",
  "user_profile_id": "uprof_01SDCCSbTxrXDpWc1phhtcfK"
}
```

## Organization › Workspaces › Rate Limits

### List Workspace Rate Limits

`$client->organization->workspaces->rateLimits->list(string workspaceID, ?GroupType groupType, ?bool includeInherited, ?int limit, ?string page): PageCursor<WorkspaceRateLimit>`

**GET** `/v1/organizations/workspaces/{workspace_id}/rate_limits`

List a workspace's rate limits.

By default, returns only the groups and limiter types that have a
workspace-level override. With `include_inherited=true`, returns every
group with organization-level limits the workspace can see, listing for
each the values it inherits from the organization as well as its own
overrides. Each value's `source` says which it is.

When `limit` is omitted, every matching entry is returned in a single
page; when `limit` truncates the result, follow `next_page` to fetch
the remaining entries.

#### Parameters

- `workspaceID: string` (path parameter)

  The ID of the workspace.

- `groupType?: optional GroupType` (query parameter)

  Filter by group type.

- `includeInherited?: optional bool` (query parameter)

  Also list the limiter values the workspace inherits from the organization, including groups with no workspace-level override.

  default: false

- `limit?: optional int` (query parameter)

  Maximum number of items to return per page. Ranges from `1` to `1000`.

  When omitted, every remaining entry is returned in a single page and `next_page` is `null`.

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class WorkspaceRateLimit`

  - `"workspace_rate_limit" type`

    Object type. Always `workspace_rate_limit` for workspace rate-limit entries.

  - `Group group`

    The rate-limit group this entry's limits apply to.

  - `list<WorkspaceRateLimitValue> limits`

    The workspace's limiter values for this group. By default only the limiter types with a workspace-level override are listed. With `include_inherited` set to `true`, the limiter types the workspace inherits from the organization are listed too, each marked by `source`.

  - `?list<string> models`

    Model names this entry's limits apply to, including aliases. `null` when `group.type` is not `"model_group"`. The list covers the models this workspace has access to, so it can differ between workspaces.

  - `string rateLimitID`

    The `id` of the organization's RateLimit entry this entry applies to.

  - `string workspaceID`

    ID of the Workspace this entry applies to.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->workspaces->rateLimits->list(
  'workspace_id',
  groupType: 'batch',
  includeInherited: true,
  limit: 1,
  page: 'page',
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "group": {
        "id": "id",
        "display_name": "display_name",
        "type": "model_group"
      },
      "limits": [
        {
          "org_limit": 0,
          "source": {
            "type": "workspace"
          },
          "type": "type",
          "value": 0
        }
      ],
      "models": [
        "string"
      ],
      "rate_limit_id": "rate_limit_id",
      "type": "workspace_rate_limit",
      "workspace_id": "workspace_id"
    }
  ],
  "next_page": "next_page"
}
```

### Set Workspace Rate Limits

`$client->organization->workspaces->rateLimits->update(string rateLimitID, string workspaceID, list<WorkspaceRateLimitUpdateValue> limits): WorkspaceRateLimit`

**POST** `/v1/organizations/workspaces/{workspace_id}/rate_limits/{rate_limit_id}`

Set or clear rate-limit overrides for one rate-limit group in a workspace.

Only the limiter types named in `limits` change: an integer `value` sets
that type's override and `null` clears it. Types not named keep their
current value. A value above the organization's own limit is stored, but
the organization limit still applies, so the lower of the two is
enforced.

Returns the targeted group's entry with this request applied, in the shape
`GET /v1/organizations/workspaces/{workspace_id}/rate_limits` returns.
Changes take effect within about an hour.

#### Parameters

- `workspaceID: string` (path parameter)

  The ID of the workspace.

- `rateLimitID: string` (path parameter)

  The `id` of the organization's rate-limit entry to set overrides for.

- `limits: list<WorkspaceRateLimitUpdateValue>`

  Limits to set or clear. Unspecified limit types are unchanged.

#### Returns

- `class WorkspaceRateLimit`

  - `"workspace_rate_limit" type`

    Object type. Always `workspace_rate_limit` for workspace rate-limit entries.

  - `Group group`

    The rate-limit group this entry's limits apply to.

  - `list<WorkspaceRateLimitValue> limits`

    The workspace's limiter values for this group. By default only the limiter types with a workspace-level override are listed. With `include_inherited` set to `true`, the limiter types the workspace inherits from the organization are listed too, each marked by `source`.

  - `?list<string> models`

    Model names this entry's limits apply to, including aliases. `null` when `group.type` is not `"model_group"`. The list covers the models this workspace has access to, so it can differ between workspaces.

  - `string rateLimitID`

    The `id` of the organization's RateLimit entry this entry applies to.

  - `string workspaceID`

    ID of the Workspace this entry applies to.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Workspaces\RateLimits\WorkspaceRateLimitType;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspaceRateLimit = $client->organization->workspaces->rateLimits->update(
  'rate_limit_id',
  workspaceID: 'workspace_id',
  limits: [['type' => WorkspaceRateLimitType::FAST_ITPMCA, 'value' => 0]],
);

var_dump($workspaceRateLimit);
```

##### Response (200)

```json
{
  "group": {
    "id": "id",
    "display_name": "display_name",
    "type": "model_group"
  },
  "limits": [
    {
      "org_limit": 0,
      "source": {
        "type": "workspace"
      },
      "type": "type",
      "value": 0
    }
  ],
  "models": [
    "string"
  ],
  "rate_limit_id": "rate_limit_id",
  "type": "workspace_rate_limit",
  "workspace_id": "workspace_id"
}
```

## Organization › Workspaces › Members

### List Workspace Members

`$client->organization->workspaces->members->list(string workspaceID, ?string afterID, ?string beforeID, ?int limit): Page<WorkspaceMember>`

**GET** `/v1/organizations/workspaces/{workspace_id}/members`

List Workspace Members

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the Workspace.

- `afterID?: optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.

- `beforeID?: optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.

- `limit?: optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

#### Returns

- `class WorkspaceMember`

  - `"workspace_member" type`

    Object type.

    For Workspace Members, this is always `"workspace_member"`.

  - `string userID`

    ID of the User.

  - `string workspaceID`

    ID of the Workspace.

  - `WorkspaceRole workspaceRole`

    Role of the Workspace Member.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->workspaces->members->list(
  'workspace_id', afterID: 'after_id', beforeID: 'before_id', limit: 1
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "type": "workspace_member",
      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
      "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
      "workspace_role": "workspace_admin"
    }
  ],
  "first_id": "first_id",
  "has_more": true,
  "last_id": "last_id"
}
```

### Create Workspace Member

`$client->organization->workspaces->members->add(string workspaceID, string userID, NoBillingWorkspaceRole workspaceRole): WorkspaceMember`

**POST** `/v1/organizations/workspaces/{workspace_id}/members`

Create Workspace Member

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the Workspace.

- `userID: string`

  ID of the User.

- `workspaceRole: NoBillingWorkspaceRole`

  Role of the new Workspace Member. Cannot be `workspace_billing`.

#### Returns

- `class WorkspaceMember`

  - `"workspace_member" type`

    Object type.

    For Workspace Members, this is always `"workspace_member"`.

  - `string userID`

    ID of the User.

  - `string workspaceID`

    ID of the Workspace.

  - `WorkspaceRole workspaceRole`

    Role of the Workspace Member.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Workspaces\NoBillingWorkspaceRole;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspaceMember = $client->organization->workspaces->members->add(
  'workspace_id',
  userID: 'user_01WxYzAbCdEfGhJkMnPqRsTu',
  workspaceRole: NoBillingWorkspaceRole::WORKSPACE_ADMIN,
);

var_dump($workspaceMember);
```

##### Response (200)

```json
{
  "type": "workspace_member",
  "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
  "workspace_role": "workspace_admin"
}
```

### Get Workspace Member

`$client->organization->workspaces->members->retrieve(string userID, string workspaceID): WorkspaceMember`

**GET** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}`

Get Workspace Member

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the Workspace.

- `userID: string` (path parameter)

  ID of the User.

#### Returns

- `class WorkspaceMember`

  - `"workspace_member" type`

    Object type.

    For Workspace Members, this is always `"workspace_member"`.

  - `string userID`

    ID of the User.

  - `string workspaceID`

    ID of the Workspace.

  - `WorkspaceRole workspaceRole`

    Role of the Workspace Member.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspaceMember = $client->organization->workspaces->members->retrieve(
  'user_id', workspaceID: 'workspace_id'
);

var_dump($workspaceMember);
```

##### Response (200)

```json
{
  "type": "workspace_member",
  "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
  "workspace_role": "workspace_admin"
}
```

### Update Workspace Member

`$client->organization->workspaces->members->update(string userID, string workspaceID, WorkspaceRole workspaceRole): WorkspaceMember`

**POST** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}`

Update Workspace Member

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the Workspace.

- `userID: string` (path parameter)

  ID of the User.

- `workspaceRole: WorkspaceRole`

  New workspace role for the User.

#### Returns

- `class WorkspaceMember`

  - `"workspace_member" type`

    Object type.

    For Workspace Members, this is always `"workspace_member"`.

  - `string userID`

    ID of the User.

  - `string workspaceID`

    ID of the Workspace.

  - `WorkspaceRole workspaceRole`

    Role of the Workspace Member.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Workspaces\WorkspaceRole;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspaceMember = $client->organization->workspaces->members->update(
  'user_id',
  workspaceID: 'workspace_id',
  workspaceRole: WorkspaceRole::WORKSPACE_ADMIN,
);

var_dump($workspaceMember);
```

##### Response (200)

```json
{
  "type": "workspace_member",
  "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
  "workspace_role": "workspace_admin"
}
```

### Delete Workspace Member

`$client->organization->workspaces->members->remove(string userID, string workspaceID): MemberRemoveResponse`

**DELETE** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}`

Delete Workspace Member

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the Workspace.

- `userID: string` (path parameter)

  ID of the User.

#### Returns

- `class MemberRemoveResponse`

  - `"workspace_member_deleted" type`

    Deleted object type.

    For Workspace Members, this is always `"workspace_member_deleted"`.

  - `string userID`

    ID of the User.

  - `string workspaceID`

    ID of the Workspace.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$member = $client->organization->workspaces->members->remove(
  'user_id', workspaceID: 'workspace_id'
);

var_dump($member);
```

##### Response (200)

```json
{
  "type": "workspace_member_deleted",
  "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu",
  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
```

## Organization › Workspaces › Service Accounts

### List Service Account Workspace Members

`$client->organization->workspaces->serviceAccounts->list(string workspaceID, ?int limit, ?string page): PageCursor<ServiceAccountWorkspaceMember>`

**GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

List the service accounts that are members of a workspace.

Each entry includes the service account's `workspace_role`. Use `limit`
and the `next_page` cursor to paginate. Archived workspaces return 400;
use `GET /service_accounts/{id}/workspaces` to audit memberships of an
archived workspace. The implicit default-workspace membership is not
included in this list. Memberships of archived service accounts are
omitted from the results.

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the workspace.

- `limit?: optional int` (query parameter)

  Number of results per page.

  default: 20

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class ServiceAccountWorkspaceMember`

  - `"service_account_workspace_member" type`

  - `?string createdByActorID`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `?bool implicit`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`).

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole workspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->workspaces->serviceAccounts->list(
  'workspace_id', limit: 1, page: 'page'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "created_by_actor_id": "created_by_actor_id",
      "implicit": true,
      "service_account_id": "service_account_id",
      "type": "service_account_workspace_member",
      "workspace_id": "workspace_id",
      "workspace_role": "workspace_admin"
    }
  ],
  "next_page": "next_page"
}
```

### Create Service Account Workspace Member

`$client->organization->workspaces->serviceAccounts->add(string workspaceID, string serviceAccountID, NoBillingWorkspaceRole workspaceRole): ServiceAccountWorkspaceMember`

**POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Add a service account to a workspace with the given `workspace_role`.

The role determines what the service account can do in the workspace and
which workspace-scoped permissions it can be granted when authenticating
through federation. Every service account is already an implicit
`workspace_user` member of the default workspace; adding it explicitly
assigns a chosen role. If the service account is already an explicit
member of the workspace, its `workspace_role` is replaced with the
value supplied here. Archived workspaces return 400. Archived service
accounts cannot be added and are rejected.

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the workspace.

- `serviceAccountID: string`

  Tagged service account ID to add.

- `workspaceRole: NoBillingWorkspaceRole`

  Role to assign to the service account in this workspace.

#### Returns

- `class ServiceAccountWorkspaceMember`

  - `"service_account_workspace_member" type`

  - `?string createdByActorID`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `?bool implicit`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`).

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole workspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Workspaces\NoBillingWorkspaceRole;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccountWorkspaceMember = $client
  ->organization
  ->workspaces
  ->serviceAccounts
  ->add(
  'workspace_id',
  serviceAccountID: 'service_account_id',
  workspaceRole: NoBillingWorkspaceRole::WORKSPACE_ADMIN,
);

var_dump($serviceAccountWorkspaceMember);
```

##### Response (200)

```json
{
  "created_by_actor_id": "created_by_actor_id",
  "implicit": true,
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member",
  "workspace_id": "workspace_id",
  "workspace_role": "workspace_admin"
}
```

### Get Service Account Workspace Member

`$client->organization->workspaces->serviceAccounts->retrieve(string serviceAccountID, string workspaceID): ServiceAccountWorkspaceMember`

**GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Retrieve a service account's membership in a workspace.

Returns the membership record, including the service account's
`workspace_role` in this workspace. Archived workspaces return 400. For
the default workspace, returns the implicit (`implicit: true`)
membership when no explicit membership exists; an explicitly added
membership is returned with its assigned role. An archived service
account returns 404.

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the workspace.

- `serviceAccountID: string` (path parameter)

  ID of the service account.

#### Returns

- `class ServiceAccountWorkspaceMember`

  - `"service_account_workspace_member" type`

  - `?string createdByActorID`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `?bool implicit`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`).

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole workspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccountWorkspaceMember = $client
  ->organization
  ->workspaces
  ->serviceAccounts
  ->retrieve('service_account_id', workspaceID: 'workspace_id');

var_dump($serviceAccountWorkspaceMember);
```

##### Response (200)

```json
{
  "created_by_actor_id": "created_by_actor_id",
  "implicit": true,
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member",
  "workspace_id": "workspace_id",
  "workspace_role": "workspace_admin"
}
```

### Update Service Account Workspace Member

`$client->organization->workspaces->serviceAccounts->update(string serviceAccountID, string workspaceID, NoBillingWorkspaceRole workspaceRole): ServiceAccountWorkspaceMember`

**POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Change a service account's role in a workspace.

The new `workspace_role` replaces the current one. Only explicit
memberships can be updated; to set a role on the implicit
default-workspace membership, add the service account explicitly with
`POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces
return 400. Archived service accounts cannot be updated and are
rejected.

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the workspace.

- `serviceAccountID: string` (path parameter)

  ID of the service account.

- `workspaceRole: NoBillingWorkspaceRole`

  New role for the service account in this workspace.

#### Returns

- `class ServiceAccountWorkspaceMember`

  - `"service_account_workspace_member" type`

  - `?string createdByActorID`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `?bool implicit`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`).

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole workspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Workspaces\NoBillingWorkspaceRole;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccountWorkspaceMember = $client
  ->organization
  ->workspaces
  ->serviceAccounts
  ->update(
  'service_account_id',
  workspaceID: 'workspace_id',
  workspaceRole: NoBillingWorkspaceRole::WORKSPACE_ADMIN,
);

var_dump($serviceAccountWorkspaceMember);
```

##### Response (200)

```json
{
  "created_by_actor_id": "created_by_actor_id",
  "implicit": true,
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member",
  "workspace_id": "workspace_id",
  "workspace_role": "workspace_admin"
}
```

### Delete Service Account Workspace Member

`$client->organization->workspaces->serviceAccounts->remove(string serviceAccountID, string workspaceID): ServiceAccountRemoveResponse`

**DELETE** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Remove a service account from a workspace.

Removal is idempotent (returns 200 even if the membership was already
removed). A DELETE against the implicit default-workspace membership
returns 200 but is a no-op and the membership persists; deleting an
explicit default-workspace row reverts to the implicit `workspace_user`
membership. Archived workspaces return 400.

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the workspace.

- `serviceAccountID: string` (path parameter)

  ID of the service account.

#### Returns

- `class ServiceAccountRemoveResponse`

  - `"service_account_workspace_member_deleted" type`

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op.

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`) named in the delete request.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccount = $client->organization->workspaces->serviceAccounts->remove(
  'service_account_id', workspaceID: 'workspace_id'
);

var_dump($serviceAccount);
```

##### Response (200)

```json
{
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member_deleted",
  "workspace_id": "workspace_id"
}
```

## Organization › Rate Limits

### List Organization Rate Limits

`$client->organization->rateLimits->list(?GroupType groupType, ?int limit, ?string model, ?string page): PageCursor<OrganizationRateLimit>`

**GET** `/v1/organizations/rate_limits`

List Messages API rate limits for your organization.

Each entry corresponds to one rate-limit group (either a model family
or an API-surface category such as the Message Batches API or the web
search tool) and contains the set of limiter values that apply to it.

When `limit` is omitted, every matching entry is returned in a single
page; when `limit` truncates the result, follow `next_page` to fetch
the remaining entries.

#### Parameters

- `groupType?: optional GroupType` (query parameter)

  Filter by group type.

- `limit?: optional int` (query parameter)

  Maximum number of items to return per page. Ranges from `1` to `1000`.

  When omitted, every remaining entry is returned in a single page and `next_page` is `null`.

- `model?: optional string` (query parameter)

  Filter to the single entry containing this model. Accepts full model names and aliases. Returns 404 if the model is not found or has no rate limits for this organization.

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class OrganizationRateLimit`

  - `"rate_limit" type`

    Object type. Always `rate_limit` for organization rate-limit entries.

  - `string id`

    Identifier of this rate-limit entry. It is stable within the organization and differs between organizations; the group's own identifier is `group.id`. Pass it as `rate_limit_id` to set a workspace's overrides for this group.

  - `Group group`

    The rate-limit group this entry's limits apply to.

  - `list<OrganizationRateLimitValue> limits`

    The limiter values that apply to this group.

  - `?list<string> models`

    Model names this entry's limits apply to, including aliases. `null` when `group.type` is not `"model_group"`. The list covers the models your organization has access to, so it can differ between organizations.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->rateLimits->list(
  groupType: 'batch', limit: 1, model: 'model', page: 'page'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "id",
      "group": {
        "id": "id",
        "display_name": "display_name",
        "type": "model_group"
      },
      "limits": [
        {
          "type": "type",
          "value": 0
        }
      ],
      "models": [
        "string"
      ],
      "type": "rate_limit"
    }
  ],
  "next_page": "next_page"
}
```

## Organization › Compliance Settings

### Get Compliance Settings

`$client->organization->complianceSettings->retrieve(): OrganizationComplianceSettings`

**GET** `/v1/organizations/compliance_settings`

Retrieve your organization's Compliance Settings.

Compliance Settings is a singleton resource: there is exactly one per
organization, addressed without an identifier. The `state` field reflects
whether the Compliance API is enabled. An organization with a parent
organization reads the state inherited from the parent's configuration.

#### Returns

- `class OrganizationComplianceSettings`

  - `"compliance_settings" type`

  - `ComplianceSettingsState state`

    Whether the Compliance API is enabled for this organization.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$organizationComplianceSettings = $client
  ->organization
  ->complianceSettings
  ->retrieve();

var_dump($organizationComplianceSettings);
```

##### Response (200)

```json
{
  "state": {
    "type": "enabled"
  },
  "type": "compliance_settings"
}
```

### Update Compliance Settings

`$client->organization->complianceSettings->update(ComplianceSettingsStateParam state): OrganizationComplianceSettings`

**POST** `/v1/organizations/compliance_settings`

Update your organization's Compliance Settings.

Setting `state` to `enabled` turns on the Compliance API and begins
capturing organization activity events. Setting it to `disabled` turns
both off. Access Transparency events are an exception: they are still
captured while the Compliance API is disabled, and the Compliance API
activity feed returns them once it is enabled again. `state` reflects
whether the Compliance API is enabled.

A request that sets `state` to its current value succeeds and leaves the
resource unchanged. A `disabled` request stays in effect until a later
`enabled` request or the organization's next provisioning action that
enables Access Transparency: enabling Access Transparency also enables
the Compliance API, which serves its activity events, so such
provisioning (including re-runs) re-enables the Compliance API even
after a `disabled` request. Automated provisioning never disables
compliance settings.

#### Parameters

- `state: ComplianceSettingsStateParam`

  Desired state. Accepts the string shorthand "enabled" or "disabled" in place of the object form; the response always returns the canonical object form.

#### Returns

- `class OrganizationComplianceSettings`

  - `"compliance_settings" type`

  - `ComplianceSettingsState state`

    Whether the Compliance API is enabled for this organization.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$organizationComplianceSettings = $client
  ->organization
  ->complianceSettings
  ->update(state: ['type' => 'enabled']);

var_dump($organizationComplianceSettings);
```

##### Response (200)

```json
{
  "state": {
    "type": "enabled"
  },
  "type": "compliance_settings"
}
```

## Organization › Analytics › Summaries

### Get Activity Summaries

`$client->organization->analytics->summaries->list(\Datetime startingDate, ?\Datetime endingDate, ?list<string> filter, ?int limit, ?string page): PageCursor<AnalyticsSingleDayActivitySummary>`

**GET** `/v1/organizations/analytics/summaries`

Get organization-wide activity summaries for a date range.

Returns one entry per day from `starting_date` (inclusive) to `ending_date`
(exclusive) in `data`, the same `data` / `next_page` envelope as the other
analytics list endpoints; the series is currently returned in full, so
`next_page` is always null.
Data is typically available with a 1-day lag and may be revised by a few
percent over the following days: when `ending_date` is omitted it
defaults to the most recent available day + 1, so the last entry covers
the most recent available day. The series can be scoped to an RBAC group
via `filter[]=rbac_group_id:{id}`. Available to organizations on a Claude
Enterprise plan. Requires an API key with the `read:analytics` scope.

#### Parameters

- `startingDate: \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. Start of the date range (inclusive). Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.

- `endingDate?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. End of the date range (exclusive). Data is typically available with a 1-day lag, so this can be at most today — which is also the default when omitted, making the last entry cover the most recent available day. Data may be revised by a few percent over the following days. The range may span at most 366 days.

- `filter?: optional list<string>` (query parameter)

  Filters as `dimension:value`. Only `rbac_group_id` is supported (e.g. `filter[]=rbac_group_id:{id}`); repeat the param to OR across groups. Scopes the whole day series to members of the matching group(s), re-aggregated from member-level activity — org-wide seat/invite fields and the adoption rates derived from them are null on scoped rows. `rbac_group_id` accepts the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each UTC day (time-of-usage attribution). At most 100 entries.

- `limit?: optional int` (query parameter)

  Number of results per page (1-1000, default 100). The day series (at most 366 entries) is currently returned in full in a single page, so `limit` does not yet shorten it.

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page` field. `next_page` is currently always null, so there is never a cursor to send.

#### Returns

- `class AnalyticsSingleDayActivitySummary`

  - `?int assignedSeatCount`

    Number of seats currently assigned to members. Null when the response is scoped to an RBAC group — seat assignment is org-wide and has no per-group analogue.

  - `int coworkDailyActiveUserCount`

    Number of users with Cowork activity on the requested day

  - `int coworkMonthlyActiveUserCount`

    Number of users with Cowork activity in the 30-day rolling window

  - `int coworkWeeklyActiveUserCount`

    Number of users with Cowork activity in the 7-day rolling window

  - `int dailyActiveUserCount`

    Number of users with token consumption on the requested day

  - `?float dailyAdoptionRate`

    Percentage of assigned seats with activity on the requested day (`DAU / assigned_seat_count * 100`). Null when the response is scoped to an RBAC group.

  - `\Datetime endingAt`

    End of the aggregation period (exclusive), UTC midnight in RFC 3339 format (e.g. `2026-01-16T00:00:00Z`).

  - `int monthlyActiveUserCount`

    Number of users with token consumption in the 30-day rolling window

  - `?float monthlyAdoptionRate`

    Percentage of assigned seats with activity in the 30-day rolling window (`MAU / assigned_seat_count * 100`). Null when the response is scoped to an RBAC group.

  - `?int pendingInviteCount`

    Number of pending invitations to join the organization. Null when the response is scoped to an RBAC group.

  - `\Datetime startingAt`

    Start of the aggregation period (inclusive), UTC midnight in RFC 3339 format (e.g. `2026-01-15T00:00:00Z`).

  - `int weeklyActiveUserCount`

    Number of users with token consumption in the 7-day rolling window

  - `?float weeklyAdoptionRate`

    Percentage of assigned seats with activity in the 7-day rolling window (`WAU / assigned_seat_count * 100`). Null when the response is scoped to an RBAC group.

  - `?int chatCoworkUnifiedDailyActiveUserCount`

    Number of users with activity in Chat and Cowork unified on the requested day. Omitted from the response where Chat and Cowork unified is not available.

  - `?int chatCoworkUnifiedMonthlyActiveUserCount`

    Number of users with activity in Chat and Cowork unified in the 28-day rolling window (30 days when the request filters by `rbac_group_id`). Omitted from the response where Chat and Cowork unified is not available.

  - `?int chatCoworkUnifiedWeeklyActiveUserCount`

    Number of users with activity in Chat and Cowork unified in the 7-day rolling window. Omitted from the response where Chat and Cowork unified is not available.

  - `?int chatDailyActiveUserCount`

    Number of users with claude.ai (chat) activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int chatMonthlyActiveUserCount`

    Number of users with claude.ai (chat) activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int chatWeeklyActiveUserCount`

    Number of users with claude.ai (chat) activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int claudeCodeDailyActiveUserCount`

    Number of users with Claude Code activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int claudeCodeMonthlyActiveUserCount`

    Number of users with Claude Code activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int claudeCodeWeeklyActiveUserCount`

    Number of users with Claude Code activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int claudeDesignDailyActiveUserCount`

    Number of users with Claude Design activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int claudeDesignMonthlyActiveUserCount`

    Number of users with Claude Design activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int claudeDesignWeeklyActiveUserCount`

    Number of users with Claude Design activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int officeAgentDailyActiveUserCount`

    Number of users with Claude in Office activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int officeAgentMonthlyActiveUserCount`

    Number of users with Claude in Office activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int officeAgentWeeklyActiveUserCount`

    Number of users with Claude in Office activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int scienceDailyActiveUserCount`

    Number of users with Claude Science activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int scienceEntitledUserCount`

    Number of users with a Claude Science seat entitlement (per-seat RBAC) at the time of the daily snapshot. The funnel top; independent of the org-level Claude Science toggle. Null when the response is scoped to an RBAC group — entitlement is org-wide and has no per-group analogue. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int scienceMonthlyActiveUserCount`

    Number of users with Claude Science activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.

  - `?int scienceWeeklyActiveUserCount`

    Number of users with Claude Science activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->analytics->summaries->list(
  startingDate: '2019-12-27',
  endingDate: '2019-12-27',
  filter: ['string'],
  limit: 1,
  page: 'page',
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "assigned_seat_count": 0,
      "cowork_daily_active_user_count": 0,
      "cowork_monthly_active_user_count": 0,
      "cowork_weekly_active_user_count": 0,
      "daily_active_user_count": 0,
      "daily_adoption_rate": 0,
      "ending_at": "2019-12-27T18:11:19.117Z",
      "monthly_active_user_count": 0,
      "monthly_adoption_rate": 0,
      "pending_invite_count": 0,
      "starting_at": "2019-12-27T18:11:19.117Z",
      "weekly_active_user_count": 0,
      "weekly_adoption_rate": 0,
      "chat_cowork_unified_daily_active_user_count": 0,
      "chat_cowork_unified_monthly_active_user_count": 0,
      "chat_cowork_unified_weekly_active_user_count": 0,
      "chat_daily_active_user_count": 0,
      "chat_monthly_active_user_count": 0,
      "chat_weekly_active_user_count": 0,
      "claude_code_daily_active_user_count": 0,
      "claude_code_monthly_active_user_count": 0,
      "claude_code_weekly_active_user_count": 0,
      "claude_design_daily_active_user_count": 0,
      "claude_design_monthly_active_user_count": 0,
      "claude_design_weekly_active_user_count": 0,
      "office_agent_daily_active_user_count": 0,
      "office_agent_monthly_active_user_count": 0,
      "office_agent_weekly_active_user_count": 0,
      "science_daily_active_user_count": 0,
      "science_entitled_user_count": 0,
      "science_monthly_active_user_count": 0,
      "science_weekly_active_user_count": 0
    }
  ],
  "next_page": "next_page"
}
```

## Organization › Analytics › Users

### List User Activity

`$client->organization->analytics->users->list(?\Datetime date, ?\Datetime endingDate, ?list<string> filter, ?list<AnalyticsUserGroupBy> groupBy, ?int limit, ?AnalyticsOrder order, ?string orderBy, ?string page, ?\Datetime startingDate): PageCursor<AnalyticsUserActivity>`

**GET** `/v1/organizations/analytics/users`

Get per-user activity for a given day, with cursor-based pagination.

Returns activity metrics for each user in the organization, sorted by email
address. Use `group_by[]` for per-RBAC-group aggregates, or `filter[]` to
scope results to specific members, groups, or a chat project. Available
to organizations on a Claude Enterprise plan. Requires an API key with
the `read:analytics` scope.

#### Parameters

- `date?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. The day to get user activity for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.

- `endingDate?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`.

- `filter?: optional list<string>` (query parameter)

  Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `project_id`, `rbac_group_id`, `user_id`. Value forms: `project_id` takes a tagged project id (`claude_proj_...`); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. A `project_id` filter limits each member's row to their claude.ai chat activity in that project and cannot be combined with `group_by[]` or an `rbac_group_id` filter. On these rows, every count in `chat_cowork_unified_metrics.sessions` is 0, because sessions are not measured per project. On any day a member sent a chat message in Chat and Cowork unified, all of that member's project activity for the day is counted in `chat_cowork_unified_metrics.chat` instead of `chat_metrics`.

- `groupBy?: optional list<AnalyticsUserGroupBy>` (query parameter)

  Dimensions to break results out by (e.g. `group_by[]=rbac_group_id`). Supported on this endpoint: `rbac_group_id`. Rows are already per-member, so the one supported grouping aggregates them per RBAC group instead. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries.

- `limit?: optional int` (query parameter)

  Number of results per page (1-1000, default 100).

- `order?: optional AnalyticsOrder` (query parameter)

  Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted.

- `orderBy?: optional string` (query parameter)

  Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set).

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page` field.

- `startingDate?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.

#### Returns

- `class AnalyticsUserActivity`

  - `AnalyticsChatMetrics chatMetrics`

    Claude.ai activity metrics for a single user on a given day.

  - `AnalyticsClaudeCodeMetrics claudeCodeMetrics`

    Claude Code activity metrics for a single user on a given day.

  - `AnalyticsCoworkMetrics coworkMetrics`

    Cowork activity metrics for a single user on a given day.

  - `AnalyticsDesignMetrics designMetrics`

    Claude Design activity metrics for a single user on a given day.

  - `?int distinctUserCount`

    Number of distinct active users represented by this row. Only set for grouped rollups (`group_by[]`); null for per-user rows. In date-range mode, recomputed as an exact distinct count of the group's active members over the requested window, never a sum of per-day values.

  - `AnalyticsOfficeMetrics officeMetrics`

    Office Agent activity metrics for a single user on a given day, broken out by Office product.

  - `AnalyticsScienceMetrics scienceMetrics`

    Claude Science activity metrics for a single user on a given day.

  - `?AnalyticsUser user`

    The user this row describes. Null on rows aggregated across users.

  - `int webSearchCount`

    Number of web searches performed

  - `?AnalyticsChatCoworkUnifiedMetrics chatCoworkUnifiedMetrics`

    Activity recorded while the member had Chat and Cowork unified (Cowork's features inside claude.ai chat) turned on, split into `chat` (chat activity) and `sessions` (Cowork activity). Omitted from the response where Chat and Cowork unified is not available.

  - `?\Datetime lastActivityDate`

    Most recent UTC day (YYYY-MM-DD) on which the user had any counted activity, within the requested window: equal to the requested `date` in single-day mode, and to the latest active day from `starting_date` (inclusive) to `ending_date` (exclusive) in date-range rollup mode — never a day earlier than the window start. On filtered requests (`filter[]`) only days matching the filter count: with `filter[]=rbac_group_id:{id}` it is the last day the user was active while a member of that group, consistent with the row's other metrics. On grouped (`group_by[]`) rows it is the latest day any member of the group was active (the requested `date` in single-day mode). Omitted from the response while last-activity reporting is not enabled for this organization.

  - `?string rbacGroupID`

    Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`.

  - `?string rbacGroupName`

    Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Analytics\AnalyticsUserGroupBy;
use Anthropic\Organization\Analytics\AnalyticsOrder;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->analytics->users->list(
  date: '2019-12-27',
  endingDate: '2019-12-27',
  filter: ['string'],
  groupBy: [AnalyticsUserGroupBy::RBAC_GROUP_ID],
  limit: 1,
  order: AnalyticsOrder::ASC,
  orderBy: 'order_by',
  page: 'page',
  startingDate: '2019-12-27',
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "chat_metrics": {
        "connectors_used_count": 0,
        "distinct_artifacts_created_count": 0,
        "distinct_connectors_used_count": 0,
        "distinct_conversation_count": 0,
        "distinct_files_uploaded_count": 0,
        "distinct_projects_created_count": 0,
        "distinct_projects_used_count": 0,
        "distinct_shared_artifacts_viewed_count": 0,
        "distinct_skills_used_count": 0,
        "message_count": 0,
        "shared_conversations_viewed_count": 0,
        "thinking_message_count": 0
      },
      "claude_code_metrics": {
        "core_metrics": {
          "artifacts_created_count": 0,
          "commit_count": 0,
          "distinct_session_count": 0,
          "lines_of_code": {
            "added_count": 0,
            "removed_count": 0
          },
          "pull_request_count": 0
        },
        "tool_actions": {
          "edit_tool": {
            "accepted_count": 0,
            "rejected_count": 0
          },
          "multi_edit_tool": {
            "accepted_count": 0,
            "rejected_count": 0
          },
          "notebook_edit_tool": {
            "accepted_count": 0,
            "rejected_count": 0
          },
          "write_tool": {
            "accepted_count": 0,
            "rejected_count": 0
          }
        }
      },
      "cowork_metrics": {
        "action_count": 0,
        "artifacts_created_count": 0,
        "connectors_used_count": 0,
        "dispatch_turn_count": 0,
        "distinct_connectors_used_count": 0,
        "distinct_plugins_used_count": 0,
        "distinct_session_count": 0,
        "distinct_skills_used_count": 0,
        "edit_tool_count": 0,
        "file_edit_count": 0,
        "message_count": 0,
        "multi_edit_tool_count": 0,
        "notebook_edit_tool_count": 0,
        "plugins_used_count": 0,
        "sessions_with_file_edits_count": 0,
        "skills_used_count": 0,
        "write_tool_count": 0
      },
      "design_metrics": {
        "distinct_projects_created_count": 0,
        "distinct_projects_used_count": 0,
        "distinct_session_count": 0,
        "message_count": 0
      },
      "distinct_user_count": 0,
      "office_metrics": {
        "excel": {
          "connectors_used_count": 0,
          "distinct_connectors_used_count": 0,
          "distinct_session_count": 0,
          "distinct_skills_used_count": 0,
          "message_count": 0,
          "skills_used_count": 0
        },
        "outlook": {
          "connectors_used_count": 0,
          "distinct_connectors_used_count": 0,
          "distinct_session_count": 0,
          "distinct_skills_used_count": 0,
          "message_count": 0,
          "skills_used_count": 0
        },
        "powerpoint": {
          "connectors_used_count": 0,
          "distinct_connectors_used_count": 0,
          "distinct_session_count": 0,
          "distinct_skills_used_count": 0,
          "message_count": 0,
          "skills_used_count": 0
        },
        "word": {
          "connectors_used_count": 0,
          "distinct_connectors_used_count": 0,
          "distinct_session_count": 0,
          "distinct_skills_used_count": 0,
          "message_count": 0,
          "skills_used_count": 0
        }
      },
      "science_metrics": {
        "delegation_count": 0,
        "distinct_session_count": 0,
        "message_count": 0,
        "remote_compute_job_count": 0,
        "skills_used_count": 0
      },
      "user": {
        "id": "id",
        "email_address": "email_address",
        "type": "user"
      },
      "web_search_count": 0,
      "chat_cowork_unified_metrics": {
        "chat": {
          "connectors_used_count": 0,
          "distinct_artifacts_created_count": 0,
          "distinct_connectors_used_count": 0,
          "distinct_conversation_count": 0,
          "distinct_files_uploaded_count": 0,
          "distinct_projects_created_count": 0,
          "distinct_projects_used_count": 0,
          "distinct_shared_artifacts_viewed_count": 0,
          "distinct_skills_used_count": 0,
          "message_count": 0,
          "shared_conversations_viewed_count": 0,
          "thinking_message_count": 0
        },
        "sessions": {
          "action_count": 0,
          "artifacts_created_count": 0,
          "connectors_used_count": 0,
          "dispatch_turn_count": 0,
          "distinct_connectors_used_count": 0,
          "distinct_plugins_used_count": 0,
          "distinct_session_count": 0,
          "distinct_skills_used_count": 0,
          "edit_tool_count": 0,
          "file_edit_count": 0,
          "message_count": 0,
          "multi_edit_tool_count": 0,
          "notebook_edit_tool_count": 0,
          "plugins_used_count": 0,
          "sessions_with_file_edits_count": 0,
          "skills_used_count": 0,
          "write_tool_count": 0
        }
      },
      "last_activity_date": "2019-12-27",
      "rbac_group_id": "rbac_group_id",
      "rbac_group_name": "rbac_group_name"
    }
  ],
  "next_page": "next_page"
}
```

## Organization › Analytics › Apps › Chat › Projects

### Get Chat Project Usage

`$client->organization->analytics->apps->chat->projects->list(?\Datetime date, ?\Datetime endingDate, ?list<string> filter, ?list<AnalyticsProjectGroupBy> groupBy, ?int limit, ?AnalyticsOrder order, ?string orderBy, ?string page, ?\Datetime startingDate): PageCursor<AnalyticsProjectActivity>`

**GET** `/v1/organizations/analytics/apps/chat/projects`

Get per-project activity for a given day, with cursor-based pagination.

Returns activity metrics for each project in the organization, sorted by
project ID. Use `group_by[]` to break projects out per member or per RBAC
group, and `filter[]` to scope results; the parameter descriptions list the
supported dimensions. Available to organizations on a Claude Enterprise
plan. Requires an API key with the `read:analytics` scope.

#### Parameters

- `date?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. The day to get project activity for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.

- `endingDate?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`.

- `filter?: optional list<string>` (query parameter)

  Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `project_id`, `rbac_group_id`, `user_id`. Value forms: `project_id` takes a tagged project id (`claude_proj_...`); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries.

- `groupBy?: optional list<AnalyticsProjectGroupBy>` (query parameter)

  Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `rbac_group_id`, `user_id`. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries.

- `limit?: optional int` (query parameter)

  Number of results per page (1-1000, default 100).

- `order?: optional AnalyticsOrder` (query parameter)

  Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted.

- `orderBy?: optional string` (query parameter)

  Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set).

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page` field.

- `startingDate?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.

#### Returns

- `class AnalyticsProjectActivity`

  - `?\Datetime createdAt`

    Project creation timestamp in RFC 3339 format. Null if the project was deleted before attribution was recorded.

  - `?AnalyticsUser createdBy`

    User who created the project. Null if the project was deleted before attribution was recorded, or if the creator's account no longer exists.

  - `?int distinctConversationCount`

    Number of distinct conversations in the project. Null on aggregated rows where a distinct count cannot be computed.

  - `int distinctUserCount`

    Number of distinct users who used the project on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values.

  - `int messageCount`

    Number of messages sent in the project on the requested day

  - `string projectID`

    Tagged project identifier (e.g. `claude_proj_...`)

  - `string projectName`

    Name of the project

  - `?string rbacGroupID`

    Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`.

  - `?string rbacGroupName`

    Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key.

  - `?string userID`

    Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Analytics\AnalyticsProjectGroupBy;
use Anthropic\Organization\Analytics\AnalyticsOrder;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->analytics->apps->chat->projects->list(
  date: '2019-12-27',
  endingDate: '2019-12-27',
  filter: ['string'],
  groupBy: [AnalyticsProjectGroupBy::RBAC_GROUP_ID],
  limit: 1,
  order: AnalyticsOrder::ASC,
  orderBy: 'order_by',
  page: 'page',
  startingDate: '2019-12-27',
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "created_at": "2019-12-27T18:11:19.117Z",
      "created_by": {
        "id": "id",
        "email_address": "email_address",
        "type": "user"
      },
      "distinct_conversation_count": 0,
      "distinct_user_count": 0,
      "message_count": 0,
      "project_id": "project_id",
      "project_name": "project_name",
      "rbac_group_id": "rbac_group_id",
      "rbac_group_name": "rbac_group_name",
      "user_id": "user_id"
    }
  ],
  "next_page": "next_page"
}
```

## Organization › Analytics › Connectors

### Get Connector Usage

`$client->organization->analytics->connectors->list(?\Datetime date, ?\Datetime endingDate, ?list<string> filter, ?list<AnalyticsConnectorGroupBy> groupBy, ?int limit, ?AnalyticsOrder order, ?string orderBy, ?string page, ?\Datetime startingDate): PageCursor<AnalyticsConnectorActivity>`

**GET** `/v1/organizations/analytics/connectors`

Get per-connector usage for a given day, with cursor-based pagination.

Returns connector usage metrics for the organization, sorted by connector
name. Connector names are normalized from their various sources — for
example, "Atlassian MCP server" and "mcp-atlassian" both appear as
"atlassian". Use `group_by[]` to break usage out per member, per RBAC
group, or per product surface, and `filter[]` to scope results; the
parameter descriptions list the supported dimensions. Available to
organizations on a Claude Enterprise plan. Requires an API key with the
`read:analytics` scope.

#### Parameters

- `date?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. The day to get connector usage for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.

- `endingDate?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`.

- `filter?: optional list<string>` (query parameter)

  Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `connector_name`, `product`, `rbac_group_id`, `user_id`. Value forms: `connector_name` matches case-insensitively, a display name such as 'GitHub MCP' also matches its normalized stored form ('github'), and for rows whose `connector_name` is an opaque connector id the connector's display name (`connector_display_name`) also matches; `product` is one of `chat_cowork_unified`, `chat`, `claude_code`, `cowork`, or `office_agent`; `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. `chat_cowork_unified` is accepted as a `product` value only where Chat and Cowork unified is available.

- `groupBy?: optional list<AnalyticsConnectorGroupBy>` (query parameter)

  Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `product`, `rbac_group_id`, `user_id`. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries.

- `limit?: optional int` (query parameter)

  Number of results per page (1-1000, default 100).

- `order?: optional AnalyticsOrder` (query parameter)

  Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted.

- `orderBy?: optional string` (query parameter)

  Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set).

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page` field.

- `startingDate?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.

#### Returns

- `class AnalyticsConnectorActivity`

  - `AnalyticsConnectorChatMetrics chatMetrics`

    Claude.ai activity metrics for a single connector on a given day.

  - `AnalyticsConnectorClaudeCodeMetrics claudeCodeMetrics`

    Claude Code activity metrics for a single connector on a given day.

  - `?string connectorDisplayName`

    Human-readable display name for rows whose `connector_name` is an opaque connector id rather than a readable name, resolved at request time from the organization's connectors (including connectors that have since been removed). `connector_name` remains the row's stable key for sorting and pagination, and `filter[]=connector_name:{value}` also matches these rows by display name. Display names are not unique, and the same connector's claude.ai usage can appear under a separate row with a readable `connector_name`. Null when `connector_name` is already a readable name, when the id cannot be resolved to one of the organization's connectors, or when display-name resolution is not enabled for this organization.

  - `string connectorName`

    Name of the connector. Some rows carry an opaque connector id here instead of a readable name; `connector_display_name` holds the resolved name for those rows.

  - `AnalyticsConnectorCoworkMetrics coworkMetrics`

    Cowork activity metrics for a single connector on a given day.

  - `int distinctUserCount`

    Number of distinct users who used the connector on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values.

  - `?int individualAuthDistinctUserCount`

    Number of distinct users whose use of this connector on the requested day ran on their own individual credential, connected through their own consent flow. Companion bucket to `managed_auth_distinct_user_count`, which carries the measurement, attribution, and null rules. Users whose requests used no stored credential count in neither bucket.

  - `?int managedAuthDistinctUserCount`

    Number of distinct users whose use of this connector on the requested day ran on Enterprise Managed Auth (an organization-managed credential provisioned through the organization's identity provider), read from the token record each request used. Null, never 0, when managed-auth reporting is not enabled for the organization, the value cannot be attributed to the row, no credentialed requests and no managed-token mint events (a managed credential being provisioned for a user's use of the connector) were observed that day, or the day predates 2026-07-01, the first day the backing data exists (forward-only data, no backfill). When credentialed requests or mint events were observed and attributed, both managed-auth fields populate, reporting 0 for a bucket with no users; the two counts are independent, not a partition — a user whose requests that day used both kinds of credential counts in both. Mint events carry user but not surface attribution, so they count as observed auth activity on `user_id` and `rbac_group_id` cuts — attributed to the user the credential was provisioned for — but never on a cut that references `product` (group or filter). Date-range rollup mode (`starting_date`/`ending_date`) computes both fields exactly over the window — distinct users with at least one qualifying day — when the whole window starts on or after 2026-07-01, with the null-versus-0 and mint-event rules applying with the window in place of the day; a range starting earlier reports every managed-auth field as null, never a partial-window value.

  - `AnalyticsConnectorOfficeMetrics officeMetrics`

    Office Agent activity metrics for a single connector on a given day, broken out by Office product.

  - `?int readCallCount`

    Number of connector tool calls on the requested day whose trusted read-only annotation marked them read-only. Call count, not distinct users. Every call recorded on a classified surface lands in exactly one of `read_call_count`, `write_call_count`, or `unclassified_call_count`, so the three sum to the day's classified calls. Classification is forward-only per surface: claude.ai from 2026-06-01, Claude Code from 2026-05-30, Claude in Office from 2026-05-29, Cowork from 2026-06-02 (Cowork clients predating annotation forwarding land in `unclassified_call_count`). Null, never 0, when the value cannot be stated: the read/write split is not enabled for this organization, or the day predates 2026-05-29. For a date-range total, sum the per-day values, but treat a window that extends before 2026-05-29 as null rather than summing only its covered days — date-range rollup mode (`starting_date`/`ending_date`) applies both rules server-side.

  - `?int unclassifiedCallCount`

    Number of connector tool calls on the requested day with no trusted read-only annotation — the annotation is optional in the MCP spec and is discarded when connector access controls are active, so unclassified calls are common. This field shows how much of the day's classified activity the read/write split actually covers. Call count, not distinct users. One of the three call-classification buckets; see `read_call_count` for the per-surface data-start dates, null conditions, and date-range guidance.

  - `?int writeCallCount`

    Number of connector tool calls on the requested day whose trusted read-only annotation marked them not read-only. Call count, not distinct users. One of the three call-classification buckets; see `read_call_count` for the per-surface data-start dates, null conditions, and date-range guidance.

  - `?AnalyticsConnectorChatCoworkUnifiedMetrics chatCoworkUnifiedMetrics`

    Connector use recorded while members had Chat and Cowork unified (Cowork's features inside claude.ai chat) turned on, split into chat conversations and Cowork sessions. A count is null in date-range mode where it cannot be computed. Omitted from the response where Chat and Cowork unified is not available.

  - `?string product`

    Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, `office_agent`, or `chat_cowork_unified` (Chat and Cowork unified). These are the canonical Cost & Usage product names; an `office_agent` row's per-surface breakdown is in its `office_metrics`. On `/plugins` only `cowork`, `claude_code` and `chat_cowork_unified` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, `cowork` and `chat_cowork_unified` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`.

  - `?string rbacGroupID`

    Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`.

  - `?string rbacGroupName`

    Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key.

  - `?string userID`

    Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Analytics\AnalyticsConnectorGroupBy;
use Anthropic\Organization\Analytics\AnalyticsOrder;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->analytics->connectors->list(
  date: '2019-12-27',
  endingDate: '2019-12-27',
  filter: ['string'],
  groupBy: [AnalyticsConnectorGroupBy::PRODUCT],
  limit: 1,
  order: AnalyticsOrder::ASC,
  orderBy: 'order_by',
  page: 'page',
  startingDate: '2019-12-27',
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "chat_metrics": {
        "distinct_conversation_connector_used_count": 0
      },
      "claude_code_metrics": {
        "distinct_session_connector_used_count": 0
      },
      "connector_display_name": "connector_display_name",
      "connector_name": "connector_name",
      "cowork_metrics": {
        "distinct_session_connector_used_count": 0
      },
      "distinct_user_count": 0,
      "individual_auth_distinct_user_count": 0,
      "managed_auth_distinct_user_count": 0,
      "office_metrics": {
        "excel": {
          "distinct_session_connector_used_count": 0
        },
        "outlook": {
          "distinct_session_connector_used_count": 0
        },
        "powerpoint": {
          "distinct_session_connector_used_count": 0
        },
        "word": {
          "distinct_session_connector_used_count": 0
        }
      },
      "read_call_count": 0,
      "unclassified_call_count": 0,
      "write_call_count": 0,
      "chat_cowork_unified_metrics": {
        "chat": {
          "distinct_conversation_connector_used_count": 0
        },
        "sessions": {
          "distinct_session_connector_used_count": 0
        }
      },
      "product": "product",
      "rbac_group_id": "rbac_group_id",
      "rbac_group_name": "rbac_group_name",
      "user_id": "user_id"
    }
  ],
  "next_page": "next_page"
}
```

## Organization › Analytics › Plugins

### Get Plugin Usage

`$client->organization->analytics->plugins->list(?\Datetime date, ?\Datetime endingDate, ?list<string> filter, ?list<AnalyticsPluginGroupBy> groupBy, ?int limit, ?AnalyticsOrder order, ?string orderBy, ?string page, ?\Datetime startingDate): PageCursor<AnalyticsPluginActivity>`

**GET** `/v1/organizations/analytics/plugins`

Get per-plugin install + invocation usage for a given day, with pagination.

Returns plugin usage metrics for the organization across Cowork and Claude
Code, sorted by plugin name. The `plugin_name` value `third-party` is
an aggregate bucket, not a plugin: it collects plugin activity, from
either surface, for which the reporting client did not provide a plugin
name — so an organization's own plugins can contribute both to their own
named rows and to this bucket. Use `group_by[]` to break usage out per
member, per RBAC group, or per product surface (Cowork / Claude Code),
and `filter[]` to scope results; the parameter descriptions list the
supported dimensions. Requires an API key with the
`read:analytics` scope. `starting_date` / `ending_date` select
range-rollup mode like `/skills`.

#### Parameters

- `date?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. The day to get plugin usage for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.

- `endingDate?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`.

- `filter?: optional list<string>` (query parameter)

  Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `plugin_name`, `product`, `rbac_group_id`, `user_id`. Value forms: `plugin_name` matches case-insensitively; `product` is `chat_cowork_unified`, `claude_code`, or `cowork` (the only surfaces with plugin attribution); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. `chat_cowork_unified` is accepted as a `product` value only where Chat and Cowork unified is available.

- `groupBy?: optional list<AnalyticsPluginGroupBy>` (query parameter)

  Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `product`, `rbac_group_id`, `user_id`. On this endpoint `product` takes the values `chat_cowork_unified`, `claude_code`, or `cowork` only (the surfaces with plugin attribution). Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries.

- `limit?: optional int` (query parameter)

  Number of results per page (1-1000, default 100).

- `order?: optional AnalyticsOrder` (query parameter)

  Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted.

- `orderBy?: optional string` (query parameter)

  Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set).

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page` field.

- `startingDate?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.

#### Returns

- `class AnalyticsPluginActivity`

  - `AnalyticsPluginClaudeCodeMetrics claudeCodeMetrics`

    Claude Code activity metrics for a single plugin on a given day.

  - `AnalyticsPluginCoworkMetrics coworkMetrics`

    Cowork activity metrics for a single plugin on a given day.

  - `int distinctUserCount`

    Number of distinct users with recorded install or invocation activity for the plugin on the requested day (install-only users count), or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values.

  - `?int installCount`

    Number of distinct users who installed the plugin on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values.

  - `int invocationCount`

    Number of plugin invocations on the requested day

  - `?string pluginID`

    Stable plugin identifier when available (e.g. `serena@claude-plugins-official`). Null for third-party Claude Code plugins (redacted at the source) and Cowork slash commands that carry only a hashed id.

  - `string pluginName`

    Name of the plugin

  - `?AnalyticsPluginChatCoworkUnifiedMetrics chatCoworkUnifiedMetrics`

    Plugin use recorded while members had Chat and Cowork unified (Cowork's features inside claude.ai chat) turned on. A count is null in date-range mode where it cannot be computed. Omitted from the response where Chat and Cowork unified is not available.

  - `?string product`

    Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, `office_agent`, or `chat_cowork_unified` (Chat and Cowork unified). These are the canonical Cost & Usage product names; an `office_agent` row's per-surface breakdown is in its `office_metrics`. On `/plugins` only `cowork`, `claude_code` and `chat_cowork_unified` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, `cowork` and `chat_cowork_unified` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`.

  - `?string rbacGroupID`

    Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`.

  - `?string rbacGroupName`

    Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key.

  - `?string userID`

    Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Analytics\AnalyticsPluginGroupBy;
use Anthropic\Organization\Analytics\AnalyticsOrder;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->analytics->plugins->list(
  date: '2019-12-27',
  endingDate: '2019-12-27',
  filter: ['string'],
  groupBy: [AnalyticsPluginGroupBy::PRODUCT],
  limit: 1,
  order: AnalyticsOrder::ASC,
  orderBy: 'order_by',
  page: 'page',
  startingDate: '2019-12-27',
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "claude_code_metrics": {
        "distinct_session_plugin_used_count": 0
      },
      "cowork_metrics": {
        "distinct_session_plugin_used_count": 0
      },
      "distinct_user_count": 0,
      "install_count": 0,
      "invocation_count": 0,
      "plugin_id": "plugin_id",
      "plugin_name": "plugin_name",
      "chat_cowork_unified_metrics": {
        "distinct_session_plugin_used_count": 0
      },
      "product": "product",
      "rbac_group_id": "rbac_group_id",
      "rbac_group_name": "rbac_group_name",
      "user_id": "user_id"
    }
  ],
  "next_page": "next_page"
}
```

## Organization › Analytics › Skills

### Get Skill Usage

`$client->organization->analytics->skills->list(?\Datetime date, ?\Datetime endingDate, ?list<string> filter, ?list<AnalyticsSkillGroupBy> groupBy, ?int limit, ?AnalyticsOrder order, ?string orderBy, ?string page, ?\Datetime startingDate): PageCursor<AnalyticsSkillActivity>`

**GET** `/v1/organizations/analytics/skills`

Get per-skill usage for a given day, with cursor-based pagination.

Returns skill usage metrics for the organization, sorted by skill name.
Use `group_by[]` to break usage out per member, per RBAC group, or per
product surface, and `filter[]` to scope results; the parameter
descriptions list the supported dimensions. Available to organizations
on a Claude Enterprise plan. Requires an API key with the
`read:analytics` scope.

#### Parameters

- `date?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. The day to get skill usage for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.

- `endingDate?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`.

- `filter?: optional list<string>` (query parameter)

  Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `product`, `rbac_group_id`, `share_status`, `skill_name`, `user_id`. Value forms: `product` is one of `chat_cowork_unified`, `chat`, `claude_code`, `cowork`, or `office_agent`; `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `share_status` is one of `organization`, `private`, or `public`; `skill_name` matches case-insensitively; `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. `chat_cowork_unified` is accepted as a `product` value only where Chat and Cowork unified is available.

- `groupBy?: optional list<AnalyticsSkillGroupBy>` (query parameter)

  Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `product`, `rbac_group_id`, `user_id`. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries.

- `limit?: optional int` (query parameter)

  Number of results per page (1-1000, default 100).

- `order?: optional AnalyticsOrder` (query parameter)

  Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted.

- `orderBy?: optional string` (query parameter)

  Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set).

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page` field.

- `startingDate?: optional \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.

#### Returns

- `class AnalyticsSkillActivity`

  - `?string attributedListPrice`

    List-price (rate-card) value of the member requests attributed to this skill, as a decimal string in the minor unit of `currency` (cents for USD), from Claude Code, Cowork, and Office Agent request-level attribution — the value of requests that involved the skill, not the skill's incremental cost. Unlike `estimated_overage_spend` this reflects usage value regardless of how it was funded — seat-covered usage counts — but it is undiscounted and does not tie to billed spend or the organization's spend reporting. claude.ai chat usage carries no request-level attribution and contributes nothing: the field is null on `chat` product rows and on `office_agent` product cuts dated before 2026-06-18 (the Office Agent attribution data-start), and on ungrouped rows it covers the Claude Code + Cowork + Office Agent share only (null when no attributable usage exists). Also null under the same conditions as `estimated_overage_spend` (spend reporting not enabled for this organization, `office_agent` product cuts before the 2026-06-18 data-start). "0" means attributable usage existed but none was attributed to this skill. Addable across days: date-range rollup mode returns the window's sum. On `group_by[]` and `filter[]` shapes both amounts can total below the ungrouped value for the same skill over the same date or range: spend attributed to a member–skill pair with no counted usage on that day is excluded from those cuts.

  - `AnalyticsSkillChatMetrics chatMetrics`

    Claude.ai activity metrics for a single skill on a given day.

  - `AnalyticsSkillClaudeCodeMetrics claudeCodeMetrics`

    Claude Code activity metrics for a single skill on a given day.

  - `AnalyticsSkillCoworkMetrics coworkMetrics`

    Cowork activity metrics for a single skill on a given day.

  - `?string currency`

    Currency for this row's monetary fields (`estimated_overage_spend` and `attributed_list_price`), as an uppercase ISO-4217 code. Always "USD" when either amount is populated; null whenever both amounts are null.

  - `int distinctUserCount`

    Number of distinct users who used the skill on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted.

  - `?int enableCount`

    Distinct accounts that enabled this skill on the requested day (claude.ai only — the skill analog of plugin `install_count`). The count is org-wide: null when enable reporting is not enabled for this organization, or when the request scopes to `user_id` / `rbac_group_id` / `product` via `group_by[]` or `filter[]` (an org-wide count would be misleading on per-cut rows). A distinct count, not an event count: summing across days double-counts members who enable the skill on more than one day, so it is also null in date-range rollup mode (`starting_date`/`ending_date`).

  - `?string estimatedOverageSpend`

    Estimated overage spend attributed to this skill, as a decimal string in the minor unit of `currency` (cents for USD; "1250" is $12.50, fractional cents possible) — an allocation of each member's daily post-discount, pre-credit metered overage spend (the same cost basis as the organization's spend reporting and the Cost & Usage API, so per-skill figures are directly comparable; spend with no skill attribution — including any member-day without skill invocations — is not represented, so skill rows sum to at most those totals) across the skills the member used. Overage only: usage covered by included seat allowances bills nothing and allocates $0 here — see `attributed_list_price` for the funding-independent usage-value companion. Claude Code, Cowork, and Office Agent spend use request-level skill attribution; claude.ai chat spend is approximated proportionally to skill-invoking messages. An estimate, not a billing number — and the cost of the requests/messages that involved the skill, not the skill's incremental cost (the same request would still have cost something without the skill active). "0" means no overage spend was attributed; null when spend reporting is not enabled for this organization, on `office_agent` product cuts dated before 2026-06-18 (the Office Agent attribution data-start). Addable across days: date-range rollup mode (`starting_date`/`ending_date`) returns the window's sum. With `group_by[]=user_id` each row carries the user's own attributed spend. On `group_by[]` and `filter[]` shapes both amounts can total below the ungrouped value for the same skill over the same date or range: spend attributed to a member–skill pair with no counted usage on that day is excluded from those cuts.

  - `?int invocationCount`

    Total number of times this skill was invoked on the requested day (the skill analog of plugin `invocation_count`). Unlike `distinct_user_count` — which answers '\# of users' — this is the true '# of uses'. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted. Null when invocation reporting is not enabled for this organization. Sum across a date range for total uses in the window — date-range rollup mode (`starting_date`/`ending_date`) returns this sum directly.

  - `AnalyticsSkillOfficeMetrics officeMetrics`

    Office Agent activity metrics for a single skill on a given day, broken out by Office product.

  - `?ShareStatus shareStatus`

    Skill share status (claude.ai only): one of `private`, `organization`, or `public`. Null for skills used only in Claude Code or Office (no per-skill share-status concept) and when share-status reporting is not yet available for the organization. Filterable via `filter[]=share_status:{value}`.

  - `?string skillDisplayName`

    Human-readable display name for rows whose `skill_name` is an opaque skill id (user/organization skill types and plugin-delivered skills, whose user-defined names usage reports generally withhold). Organization-shared skills and skills delivered by the organization's own plugins (its plugin marketplaces and its library) resolve; plugin skill names are shown without their 'plugin:' prefix. The literal 'unknown' bucket row gets a fixed 'Unknown skill' label. For a member's own skill (private or personal-plugin) it is null, except when the skill's owner used it from Claude Code or Cowork in the requested period: then it shows the name that client reported at the time. Apart from that, the names of members' own skills are not disclosed to analytics-key holders. Also null for Anthropic-provided plugin skills (not resolved), for an organization skill or plugin whose name can no longer be found (for example, one since deleted), when `skill_name` is already a display name, or when display-name resolution is not enabled for this organization.

  - `string skillName`

    Name of the skill

  - `?AnalyticsSkillChatCoworkUnifiedMetrics chatCoworkUnifiedMetrics`

    Skill use recorded while members had Chat and Cowork unified (Cowork's features inside claude.ai chat) turned on, split into chat conversations and Cowork sessions. A count is null in date-range mode where it cannot be computed. Omitted from the response where Chat and Cowork unified is not available.

  - `?string product`

    Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, `office_agent`, or `chat_cowork_unified` (Chat and Cowork unified). These are the canonical Cost & Usage product names; an `office_agent` row's per-surface breakdown is in its `office_metrics`. On `/plugins` only `cowork`, `claude_code` and `chat_cowork_unified` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, `cowork` and `chat_cowork_unified` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`.

  - `?string rbacGroupID`

    Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`.

  - `?string rbacGroupName`

    Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key.

  - `?string userID`

    Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Analytics\AnalyticsSkillGroupBy;
use Anthropic\Organization\Analytics\AnalyticsOrder;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->analytics->skills->list(
  date: '2019-12-27',
  endingDate: '2019-12-27',
  filter: ['string'],
  groupBy: [AnalyticsSkillGroupBy::PRODUCT],
  limit: 1,
  order: AnalyticsOrder::ASC,
  orderBy: 'order_by',
  page: 'page',
  startingDate: '2019-12-27',
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "attributed_list_price": "attributed_list_price",
      "chat_metrics": {
        "distinct_conversation_skill_used_count": 0
      },
      "claude_code_metrics": {
        "distinct_session_skill_used_count": 0
      },
      "cowork_metrics": {
        "distinct_session_skill_used_count": 0
      },
      "currency": "currency",
      "distinct_user_count": 0,
      "enable_count": 0,
      "estimated_overage_spend": "estimated_overage_spend",
      "invocation_count": 0,
      "office_metrics": {
        "excel": {
          "distinct_session_skill_used_count": 0
        },
        "outlook": {
          "distinct_session_skill_used_count": 0
        },
        "powerpoint": {
          "distinct_session_skill_used_count": 0
        },
        "word": {
          "distinct_session_skill_used_count": 0
        }
      },
      "share_status": "organization",
      "skill_display_name": "skill_display_name",
      "skill_name": "skill_name",
      "chat_cowork_unified_metrics": {
        "chat": {
          "distinct_conversation_skill_used_count": 0
        },
        "sessions": {
          "distinct_session_skill_used_count": 0
        }
      },
      "product": "product",
      "rbac_group_id": "rbac_group_id",
      "rbac_group_name": "rbac_group_name",
      "user_id": "user_id"
    }
  ],
  "next_page": "next_page"
}
```

## Organization › Analytics › Artifacts

### Get Artifact Activity

`$client->organization->analytics->artifacts->list(\Datetime date, ?list<string> filter, ?list<AnalyticsArtifactGroupBy> groupBy, ?int limit, ?string page): PageCursor<AnalyticsArtifactActivity>`

**GET** `/v1/organizations/analytics/artifacts`

Get artifact-creation activity for a given day, broken out by MIME type.

Returns the full (`artifact_type`, `is_shared`) cube for the organization;
`next_page` is null except for grouped queries, which paginate. The cube
can be broken out per product, per member, or per RBAC group via
`group_by[]`, and scoped via `filter[]`. Requires an API key with the
`read:analytics` scope.

#### Parameters

- `date: \Datetime` (query parameter)

  UTC date in YYYY-MM-DD format. The day to get artifact activity for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01.

- `filter?: optional list<string>` (query parameter)

  Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `artifact_type`, `is_shared`, `product`, `rbac_group_id`, `user_id`. Value forms: `artifact_type` is a canonical artifact MIME type (e.g. `text/markdown`) or `other`; `is_shared` is `true` or `false`; `product` is `chat_cowork_unified`, `chat`, `claude_code`, or `cowork` (the surfaces that create artifacts); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. `chat_cowork_unified` is accepted as a `product` value only where Chat and Cowork unified is available.

- `groupBy?: optional list<AnalyticsArtifactGroupBy>` (query parameter)

  Dimensions to break results out by: `product`, `user_id` and/or `rbac_group_id`. The ungrouped artifact-type cube is finite and returned in full; grouped queries multiply the cube and paginate via `next_page`. `product` takes the values `chat_cowork_unified`, `chat`, `claude_code`, or `cowork` (the surfaces that create artifacts). `rbac_group_id` attributes a user to every group they held at any point during the requested UTC day, so grouped rows are not an exclusive partition. At most 100 entries.

- `limit?: optional int` (query parameter)

  Maximum rows to return (1-1000, default 100). The ungrouped artifact-type cube is finite and returned in full; `limit` is the page size only when `group_by[]` multiplies the cube.

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page` field. Only valid with `group_by[]` — the ungrouped cube is never paginated.

#### Returns

- `class AnalyticsArtifactActivity`

  - `string artifactType`

    Canonical artifact MIME type (e.g. `text/markdown`, `application/vnd.ant.react`, `image/svg+xml`), or `other`. Claude Code and Cowork artifacts report as `text/html`.

  - `int artifactsCreatedCount`

    Number of artifacts created in this bucket on the requested day

  - `int distinctUserCount`

    Number of distinct users who created artifacts in this bucket on the requested day

  - `bool isShared`

    Whether the artifacts in this bucket have ever been shared (a Claude Code / Cowork artifact is shared once anyone beyond its creator may open it: named members, the whole organization, or anyone with the link).

  - `int publishedArtifactsCreatedCount`

    Number of those artifacts that have been published (for Claude Code / Cowork artifacts: open to anyone with the link); never exceeds `artifacts_created_count`

  - `?string product`

    Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, `office_agent`, or `chat_cowork_unified` (Chat and Cowork unified). These are the canonical Cost & Usage product names; an `office_agent` row's per-surface breakdown is in its `office_metrics`. On `/plugins` only `cowork`, `claude_code` and `chat_cowork_unified` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, `cowork` and `chat_cowork_unified` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`.

  - `?string rbacGroupID`

    Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`.

  - `?string rbacGroupName`

    Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key.

  - `?string userID`

    Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Analytics\AnalyticsArtifactGroupBy;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->analytics->artifacts->list(
  date: '2019-12-27',
  filter: ['string'],
  groupBy: [AnalyticsArtifactGroupBy::PRODUCT],
  limit: 1,
  page: 'page',
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "artifact_type": "artifact_type",
      "artifacts_created_count": 0,
      "distinct_user_count": 0,
      "is_shared": true,
      "published_artifacts_created_count": 0,
      "product": "product",
      "rbac_group_id": "rbac_group_id",
      "rbac_group_name": "rbac_group_name",
      "user_id": "user_id"
    }
  ],
  "next_page": "next_page"
}
```

## Organization › Spend Limits › Effective

### List Effective Spend Limits

`$client->organization->spendLimits->effective->list(?int limit, ?string page, ?list<SpendLimitPeriod> period, ?list<string> userIDs): PageCursor<SpendSummary>`

**GET** `/v1/organizations/spend_limits/effective`

List each member's effective spend limit and period-to-date spend.

Returns one row per (member, period) the member resolves a spend limit
for, with the `source` scope the spend limit was inherited from.
Paginates by member, so a member's periods never split across pages.
Supported for Claude Enterprise organizations only, not for Claude Console
organizations.

#### Parameters

- `limit?: optional int` (query parameter)

  Maximum number of members per page. A member's period rows never split across pages, so a page may carry more rows than this. Defaults to `20`.

  default: 20

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page` field.

- `period?: optional list<SpendLimitPeriod>` (query parameter)

  Restrict the report to these limit periods. Omit to return one row per period each member resolves a spend limit for.

- `userIDs?: optional list<string>` (query parameter)

  Restrict the report to these members, by tagged user ID (`user_...`). At most 100 entries.

#### Returns

- `class SpendSummary`

  - `Actor actor`

  - `?string amount`

    Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member.

  - `string currency`

    ISO 4217 code of the organization's billing currency; the unit for `amount` and `period_to_date_spend`.

  - `SpendLimitPeriod period`

    Period this row's effective limit and spend are reported for.

  - `string periodToDateSpend`

    The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable.

  - `Scope scope`

  - `Source source`

  - `string spendLimitID`

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\SpendLimits\SpendLimitPeriod;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->spendLimits->effective->list(
  limit: 1, page: 'page', period: [SpendLimitPeriod::DAILY], userIDs: ['string']
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "actor": {
        "deleted": true,
        "email_address": "email_address",
        "name": "name",
        "type": "user_actor",
        "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
      },
      "amount": "50000",
      "currency": "USD",
      "period": "daily",
      "period_to_date_spend": "12050.5",
      "scope": {
        "type": "user",
        "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
      },
      "source": {
        "type": "user",
        "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
      },
      "spend_limit_id": "spend_limit_id"
    }
  ],
  "next_page": "next_page"
}
```

## Organization › Spend Limits › Increase Requests

### List Spend Limit Increase Requests

`$client->organization->spendLimits->increaseRequests->list(?list<string> actorIDs, ?int limit, ?string page, ?list<SpendLimitIncreaseRequestStatus> status): PageCursor<SpendLimitIncreaseRequest>`

**GET** `/v1/organizations/spend_limit_increase_requests`

List spend limit increase requests, most recent first.

Pending requests include a live `spend_summary` for the requester.
Requests whose requester is no longer a member are excluded.

#### Parameters

- `actorIDs?: optional list<string>` (query parameter)

  Filter by requester, as `user_...` tagged IDs.

- `limit?: optional int` (query parameter)

  default: 20

- `page?: optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

- `status?: optional list<SpendLimitIncreaseRequestStatus>` (query parameter)

  Filter by status. Omit to return all.

#### Returns

- `class SpendLimitIncreaseRequest`

  - `"spend_limit_increase_request" type`

  - `string id`

  - `SpendLimitIncreaseRequestActor actor`

    Who submitted the increase request.

  - `\Datetime createdAt`

  - `SpendLimitPeriod period`

  - `?\Datetime resolvedAt`

  - `?SpendLimitIncreaseRequestResolvedBy resolvedBy`

    Who approved or denied the increase request.

  - `?SpendSummary spendSummary`

    Per-member effective-limit report row (`GET /spend_limits/effective`).

  - `SpendLimitIncreaseRequestStatus status`

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\SpendLimits\IncreaseRequests\SpendLimitIncreaseRequestStatus;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->spendLimits->increaseRequests->list(
  actorIDs: ['string'],
  limit: 1,
  page: 'page',
  status: [SpendLimitIncreaseRequestStatus::APPROVED],
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "id",
      "actor": {
        "deleted": true,
        "email_address": "email_address",
        "name": "name",
        "type": "user_actor",
        "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
      },
      "created_at": "2019-12-27T18:11:19.117Z",
      "period": "daily",
      "resolved_at": "2019-12-27T18:11:19.117Z",
      "resolved_by": {
        "deleted": true,
        "email_address": "email_address",
        "name": "name",
        "type": "user_actor",
        "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
      },
      "spend_summary": {
        "actor": {
          "deleted": true,
          "email_address": "email_address",
          "name": "name",
          "type": "user_actor",
          "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
        },
        "amount": "50000",
        "currency": "USD",
        "period": "daily",
        "period_to_date_spend": "12050.5",
        "scope": {
          "type": "user",
          "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
        },
        "source": {
          "type": "user",
          "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
        },
        "spend_limit_id": "spend_limit_id"
      },
      "status": "approved",
      "type": "spend_limit_increase_request"
    }
  ],
  "next_page": "next_page"
}
```

### Get Spend Limit Increase Request

`$client->organization->spendLimits->increaseRequests->retrieve(string spendLimitIncreaseRequestID): SpendLimitIncreaseRequest`

**GET** `/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}`

Retrieve a spend limit increase request.

While `pending`, the response includes a live `spend_summary` for the
requester at the request's period.

#### Parameters

- `spendLimitIncreaseRequestID: string` (path parameter)

  ID of the spend limit increase request.

#### Returns

- `class SpendLimitIncreaseRequest`

  - `"spend_limit_increase_request" type`

  - `string id`

  - `SpendLimitIncreaseRequestActor actor`

    Who submitted the increase request.

  - `\Datetime createdAt`

  - `SpendLimitPeriod period`

  - `?\Datetime resolvedAt`

  - `?SpendLimitIncreaseRequestResolvedBy resolvedBy`

    Who approved or denied the increase request.

  - `?SpendSummary spendSummary`

    Per-member effective-limit report row (`GET /spend_limits/effective`).

  - `SpendLimitIncreaseRequestStatus status`

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$spendLimitIncreaseRequest = $client
  ->organization
  ->spendLimits
  ->increaseRequests
  ->retrieve('spend_limit_increase_request_id');

var_dump($spendLimitIncreaseRequest);
```

##### Response (200)

```json
{
  "id": "id",
  "actor": {
    "deleted": true,
    "email_address": "email_address",
    "name": "name",
    "type": "user_actor",
    "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
  },
  "created_at": "2019-12-27T18:11:19.117Z",
  "period": "daily",
  "resolved_at": "2019-12-27T18:11:19.117Z",
  "resolved_by": {
    "deleted": true,
    "email_address": "email_address",
    "name": "name",
    "type": "user_actor",
    "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
  },
  "spend_summary": {
    "actor": {
      "deleted": true,
      "email_address": "email_address",
      "name": "name",
      "type": "user_actor",
      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
    },
    "amount": "50000",
    "currency": "USD",
    "period": "daily",
    "period_to_date_spend": "12050.5",
    "scope": {
      "type": "user",
      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
    },
    "source": {
      "type": "user",
      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
    },
    "spend_limit_id": "spend_limit_id"
  },
  "status": "approved",
  "type": "spend_limit_increase_request"
}
```

### Approve Spend Limit Increase Request

`$client->organization->spendLimits->increaseRequests->approve(string spendLimitIncreaseRequestID, string amount, ?SpendLimitPeriod period, ?bool suppressNotification): IncreaseRequestApproveResponse`

**POST** `/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}/approve`

Approve a pending spend limit increase request.

Writes a per-user spend limit at `amount` for the requester and
transitions the request to `approved`. `period` defaults to the period
the member was blocked on. Anthropic emails the requester unless
`suppress_notification` is set.

#### Parameters

- `spendLimitIncreaseRequestID: string` (path parameter)

  ID of the spend limit increase request.

- `amount: string`

  New per-user spend limit as a non-negative integer decimal string (minor units).

- `period?: optional SpendLimitPeriod`

- `suppressNotification?: optional bool`

#### Returns

- `class IncreaseRequestApproveResponse`

  - `"spend_limit_increase_request" type`

  - `string id`

  - `SpendLimitIncreaseRequestActor actor`

    Who submitted the increase request.

  - `\Datetime createdAt`

  - `SpendLimitPeriod period`

  - `?\Datetime resolvedAt`

  - `?SpendLimitIncreaseRequestResolvedBy resolvedBy`

    Who approved or denied the increase request.

  - `?SpendLimit spendLimit`

    A configured spend limit: a cap on metered spend for one scope and period.

  - `?SpendSummary spendSummary`

    Per-member effective-limit report row (`GET /spend_limits/effective`).

  - `SpendLimitIncreaseRequestStatus status`

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\SpendLimits\SpendLimitPeriod;

$client = new Client(apiKey: 'my-anthropic-api-key');

$response = $client->organization->spendLimits->increaseRequests->approve(
  'spend_limit_increase_request_id',
  amount: '50000',
  period: SpendLimitPeriod::MONTHLY,
  suppressNotification: true,
);

var_dump($response);
```

##### Response (200)

```json
{
  "id": "id",
  "actor": {
    "deleted": true,
    "email_address": "email_address",
    "name": "name",
    "type": "user_actor",
    "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
  },
  "created_at": "2019-12-27T18:11:19.117Z",
  "period": "daily",
  "resolved_at": "2019-12-27T18:11:19.117Z",
  "resolved_by": {
    "deleted": true,
    "email_address": "email_address",
    "name": "name",
    "type": "user_actor",
    "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
  },
  "spend_limit": {
    "id": "id",
    "amount": "50000",
    "created_at": "2019-12-27T18:11:19.117Z",
    "currency": "USD",
    "is_enabled": true,
    "period": "daily",
    "scope": {
      "type": "user",
      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
    },
    "type": "spend_limit",
    "updated_at": "2019-12-27T18:11:19.117Z"
  },
  "spend_summary": {
    "actor": {
      "deleted": true,
      "email_address": "email_address",
      "name": "name",
      "type": "user_actor",
      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
    },
    "amount": "50000",
    "currency": "USD",
    "period": "daily",
    "period_to_date_spend": "12050.5",
    "scope": {
      "type": "user",
      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
    },
    "source": {
      "type": "user",
      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
    },
    "spend_limit_id": "spend_limit_id"
  },
  "status": "approved",
  "type": "spend_limit_increase_request"
}
```

### Deny Spend Limit Increase Request

`$client->organization->spendLimits->increaseRequests->deny(string spendLimitIncreaseRequestID, ?bool suppressNotification): SpendLimitIncreaseRequest`

**POST** `/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}/deny`

Deny a pending spend limit increase request.

Idempotent on `denied`; denying an already-`approved` request returns
400. Anthropic emails the requester unless `suppress_notification` is set.

#### Parameters

- `spendLimitIncreaseRequestID: string` (path parameter)

  ID of the spend limit increase request.

- `suppressNotification?: optional bool`

#### Returns

- `class SpendLimitIncreaseRequest`

  - `"spend_limit_increase_request" type`

  - `string id`

  - `SpendLimitIncreaseRequestActor actor`

    Who submitted the increase request.

  - `\Datetime createdAt`

  - `SpendLimitPeriod period`

  - `?\Datetime resolvedAt`

  - `?SpendLimitIncreaseRequestResolvedBy resolvedBy`

    Who approved or denied the increase request.

  - `?SpendSummary spendSummary`

    Per-member effective-limit report row (`GET /spend_limits/effective`).

  - `SpendLimitIncreaseRequestStatus status`

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$spendLimitIncreaseRequest = $client
  ->organization
  ->spendLimits
  ->increaseRequests
  ->deny('spend_limit_increase_request_id', suppressNotification: true);

var_dump($spendLimitIncreaseRequest);
```

##### Response (200)

```json
{
  "id": "id",
  "actor": {
    "deleted": true,
    "email_address": "email_address",
    "name": "name",
    "type": "user_actor",
    "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
  },
  "created_at": "2019-12-27T18:11:19.117Z",
  "period": "daily",
  "resolved_at": "2019-12-27T18:11:19.117Z",
  "resolved_by": {
    "deleted": true,
    "email_address": "email_address",
    "name": "name",
    "type": "user_actor",
    "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
  },
  "spend_summary": {
    "actor": {
      "deleted": true,
      "email_address": "email_address",
      "name": "name",
      "type": "user_actor",
      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
    },
    "amount": "50000",
    "currency": "USD",
    "period": "daily",
    "period_to_date_spend": "12050.5",
    "scope": {
      "type": "user",
      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
    },
    "source": {
      "type": "user",
      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
    },
    "spend_limit_id": "spend_limit_id"
  },
  "status": "approved",
  "type": "spend_limit_increase_request"
}
```

## Organization › RBAC Groups

### Create RBAC Group

`$client->organization->rbacGroups->create(string name): RBACGroup`

**POST** `/v1/organizations/rbac_groups`

Create an RBAC Group in the Claude Enterprise tenant. Groups created via the API have source type `"direct"`.

The RBAC Groups API is available to Claude Enterprise organizations only.

#### Parameters

- `name: string`

  Name of the RBAC Group. Not uniqueness-enforced.

#### Returns

- `class RBACGroup`

  - `"rbac_group" type`

    Object type.

    For RBAC Groups, this is always `"rbac_group"`.

  - `string id`

    ID of the RBAC Group.

  - `\Datetime createdAt`

    RFC 3339 timestamp of when the RBAC Group was created.

  - `string name`

    Name of the RBAC Group. Not uniqueness-enforced.

  - `?list<string> roleIDs`

    RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.

  - `SourceType sourceType`

    How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.

  - `\Datetime updatedAt`

    RFC 3339 timestamp of when the RBAC Group was last updated.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$rbacGroup = $client->organization->rbacGroups->create(name: 'Engineering');

var_dump($rbacGroup);
```

##### Response (200)

```json
{
  "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "name": "Engineering",
  "role_ids": [
    "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
  ],
  "source_type": "direct",
  "type": "rbac_group",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}
```

### List RBAC Groups

`$client->organization->rbacGroups->list(?int limit, ?string page): PageCursor<RBACGroup>`

**GET** `/v1/organizations/rbac_groups`

List RBAC Groups in the Claude Enterprise tenant.

The RBAC Groups API is available to Claude Enterprise organizations only.

#### Parameters

- `limit?: optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

- `page?: optional string` (query parameter)

  Optionally set to the `next_page` token from the previous response.

#### Returns

- `class RBACGroup`

  - `"rbac_group" type`

    Object type.

    For RBAC Groups, this is always `"rbac_group"`.

  - `string id`

    ID of the RBAC Group.

  - `\Datetime createdAt`

    RFC 3339 timestamp of when the RBAC Group was created.

  - `string name`

    Name of the RBAC Group. Not uniqueness-enforced.

  - `?list<string> roleIDs`

    RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.

  - `SourceType sourceType`

    How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.

  - `\Datetime updatedAt`

    RFC 3339 timestamp of when the RBAC Group was last updated.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->rbacGroups->list(
  limit: 1, page: 'eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
      "created_at": "2024-10-30T23:58:27.427722Z",
      "name": "Engineering",
      "role_ids": [
        "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
      ],
      "source_type": "direct",
      "type": "rbac_group",
      "updated_at": "2024-10-30T23:58:27.427722Z"
    }
  ],
  "has_more": false,
  "next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9"
}
```

### Get RBAC Group

`$client->organization->rbacGroups->retrieve(string rbacGroupID): RBACGroup`

**GET** `/v1/organizations/rbac_groups/{rbac_group_id}`

Retrieve an RBAC Group by ID.

The RBAC Groups API is available to Claude Enterprise organizations only.

#### Parameters

- `rbacGroupID: string` (path parameter)

  ID of the RBAC Group.

#### Returns

- `class RBACGroup`

  - `"rbac_group" type`

    Object type.

    For RBAC Groups, this is always `"rbac_group"`.

  - `string id`

    ID of the RBAC Group.

  - `\Datetime createdAt`

    RFC 3339 timestamp of when the RBAC Group was created.

  - `string name`

    Name of the RBAC Group. Not uniqueness-enforced.

  - `?list<string> roleIDs`

    RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.

  - `SourceType sourceType`

    How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.

  - `\Datetime updatedAt`

    RFC 3339 timestamp of when the RBAC Group was last updated.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$rbacGroup = $client->organization->rbacGroups->retrieve('rbac_group_id');

var_dump($rbacGroup);
```

##### Response (200)

```json
{
  "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "name": "Engineering",
  "role_ids": [
    "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
  ],
  "source_type": "direct",
  "type": "rbac_group",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}
```

### Update RBAC Group

`$client->organization->rbacGroups->update(string rbacGroupID, ?string name): RBACGroup`

**POST** `/v1/organizations/rbac_groups/{rbac_group_id}`

Update an RBAC Group's name. Groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

The RBAC Groups API is available to Claude Enterprise organizations only.

#### Parameters

- `rbacGroupID: string` (path parameter)

  ID of the RBAC Group.

- `name?: optional string`

  Name of the RBAC Group. Not uniqueness-enforced.

#### Returns

- `class RBACGroup`

  - `"rbac_group" type`

    Object type.

    For RBAC Groups, this is always `"rbac_group"`.

  - `string id`

    ID of the RBAC Group.

  - `\Datetime createdAt`

    RFC 3339 timestamp of when the RBAC Group was created.

  - `string name`

    Name of the RBAC Group. Not uniqueness-enforced.

  - `?list<string> roleIDs`

    RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.

  - `SourceType sourceType`

    How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.

  - `\Datetime updatedAt`

    RFC 3339 timestamp of when the RBAC Group was last updated.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$rbacGroup = $client->organization->rbacGroups->update(
  'rbac_group_id', name: 'Engineering'
);

var_dump($rbacGroup);
```

##### Response (200)

```json
{
  "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "name": "Engineering",
  "role_ids": [
    "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
  ],
  "source_type": "direct",
  "type": "rbac_group",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}
```

### Delete RBAC Group

`$client->organization->rbacGroups->delete(string rbacGroupID): DeletedRBACGroup`

**DELETE** `/v1/organizations/rbac_groups/{rbac_group_id}`

Delete an RBAC Group. Groups provisioned by an identity provider (source type `"scim"`) cannot be deleted via the API while an organization in the tenant uses SCIM provisioning.

The RBAC Groups API is available to Claude Enterprise organizations only.

#### Parameters

- `rbacGroupID: string` (path parameter)

  ID of the RBAC Group.

#### Returns

- `class DeletedRBACGroup`

  - `"rbac_group_deleted" type`

    Deleted object type.

    For RBAC Groups, this is always `"rbac_group_deleted"`.

  - `string id`

    ID of the RBAC Group.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$deletedRBACGroup = $client->organization->rbacGroups->delete('rbac_group_id');

var_dump($deletedRBACGroup);
```

##### Response (200)

```json
{
  "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
  "type": "rbac_group_deleted"
}
```

## Organization › RBAC Groups › Members

### List RBAC Group Members

`$client->organization->rbacGroups->members->list(string rbacGroupID, ?int limit, ?string page): PageCursor<RBACGroupMember>`

**GET** `/v1/organizations/rbac_groups/{rbac_group_id}/members`

List members of an RBAC Group.

The RBAC Groups API is available to Claude Enterprise organizations only.

#### Parameters

- `rbacGroupID: string` (path parameter)

  ID of the RBAC Group.

- `limit?: optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

- `page?: optional string` (query parameter)

  Optionally set to the `next_page` token from the previous response.

#### Returns

- `class RBACGroupMember`

  - `"rbac_group_member" type`

    Object type.

    For RBAC Group Members, this is always `"rbac_group_member"`.

  - `\Datetime createdAt`

    RFC 3339 timestamp of when the User was added to the RBAC Group.

  - `string email`

    Email of the User.

  - `string rbacGroupID`

    ID of the RBAC Group.

  - `string userID`

    ID of the User.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->rbacGroups->members->list(
  'rbac_group_id', limit: 1, page: 'eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "created_at": "2024-10-30T23:58:27.427722Z",
      "email": "user@emaildomain.com",
      "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
      "type": "rbac_group_member",
      "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
    }
  ],
  "has_more": false,
  "next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9"
}
```

### Add RBAC Group Member

`$client->organization->rbacGroups->members->add(string rbacGroupID, string userID): RBACGroupMember`

**POST** `/v1/organizations/rbac_groups/{rbac_group_id}/members`

Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

The RBAC Groups API is available to Claude Enterprise organizations only.

#### Parameters

- `rbacGroupID: string` (path parameter)

  ID of the RBAC Group.

- `userID: string`

  ID of the User.

#### Returns

- `class RBACGroupMember`

  - `"rbac_group_member" type`

    Object type.

    For RBAC Group Members, this is always `"rbac_group_member"`.

  - `\Datetime createdAt`

    RFC 3339 timestamp of when the User was added to the RBAC Group.

  - `string email`

    Email of the User.

  - `string rbacGroupID`

    ID of the RBAC Group.

  - `string userID`

    ID of the User.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$rbacGroupMember = $client->organization->rbacGroups->members->add(
  'rbac_group_id', userID: 'user_01WxYzAbCdEfGhJkMnPqRsTu'
);

var_dump($rbacGroupMember);
```

##### Response (200)

```json
{
  "created_at": "2024-10-30T23:58:27.427722Z",
  "email": "user@emaildomain.com",
  "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
  "type": "rbac_group_member",
  "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
}
```

### Remove RBAC Group Member

`$client->organization->rbacGroups->members->remove(string userID, string rbacGroupID): DeletedRBACGroupMember`

**DELETE** `/v1/organizations/rbac_groups/{rbac_group_id}/members/{user_id}`

Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

The RBAC Groups API is available to Claude Enterprise organizations only.

#### Parameters

- `rbacGroupID: string` (path parameter)

  ID of the RBAC Group.

- `userID: string` (path parameter)

  ID of the User.

#### Returns

- `class DeletedRBACGroupMember`

  - `"rbac_group_member_deleted" type`

    Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`.

  - `string rbacGroupID`

    ID of the RBAC Group.

  - `string userID`

    ID of the User.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$deletedRBACGroupMember = $client->organization->rbacGroups->members->remove(
  'user_id', rbacGroupID: 'rbac_group_id'
);

var_dump($deletedRBACGroupMember);
```

##### Response (200)

```json
{
  "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
  "type": "rbac_group_member_deleted",
  "user_id": "user_01WxYzAbCdEfGhJkMnPqRsTu"
}
```

## Organization › RBAC Roles

### List RBAC Roles

`$client->organization->rbacRoles->list(?int limit, ?string page): PageCursor<RBACRole>`

**GET** `/v1/organizations/rbac_roles`

List RBAC Roles in the organization.

The RBAC Roles API is available to Claude Enterprise organizations only.

#### Parameters

- `limit?: optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

- `page?: optional string` (query parameter)

  Optionally set to the `next_page` token from the previous response.

#### Returns

- `class RBACRole`

  - `"rbac_role" type`

    Object type.

    For RBAC Roles, this is always `"rbac_role"`.

  - `string id`

    ID of the RBAC Role.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the RBAC Role was created.

  - `string displayName`

    Name of the RBAC Role. For a role created by Anthropic, this name can differ from the label claude.ai shows, and Anthropic may change the name. To keep a lasting reference to a role, store its `id`.

  - `\Datetime updatedAt`

    RFC 3339 datetime string indicating when the RBAC Role was last updated.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->rbacRoles->list(
  limit: 1, page: 'eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s",
      "created_at": "2024-10-30T23:58:27.427722Z",
      "display_name": "Project Editor",
      "type": "rbac_role",
      "updated_at": "2024-10-30T23:58:27.427722Z"
    }
  ],
  "has_more": true,
  "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"
}
```

### Get RBAC Role

`$client->organization->rbacRoles->retrieve(string rbacRoleID): RBACRole`

**GET** `/v1/organizations/rbac_roles/{rbac_role_id}`

Retrieve an RBAC Role by ID.

The RBAC Roles API is available to Claude Enterprise organizations only.

#### Parameters

- `rbacRoleID: string` (path parameter)

  ID of the RBAC Role.

#### Returns

- `class RBACRole`

  - `"rbac_role" type`

    Object type.

    For RBAC Roles, this is always `"rbac_role"`.

  - `string id`

    ID of the RBAC Role.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the RBAC Role was created.

  - `string displayName`

    Name of the RBAC Role. For a role created by Anthropic, this name can differ from the label claude.ai shows, and Anthropic may change the name. To keep a lasting reference to a role, store its `id`.

  - `\Datetime updatedAt`

    RFC 3339 datetime string indicating when the RBAC Role was last updated.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$rbacRole = $client->organization->rbacRoles->retrieve('rbac_role_id');

var_dump($rbacRole);
```

##### Response (200)

```json
{
  "id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "Project Editor",
  "type": "rbac_role",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}
```

## Organization › RBAC Roles › Permissions

### List RBAC Role Permissions

`$client->organization->rbacRoles->permissions->list(string rbacRoleID, ?int limit, ?string page): PageCursor<RBACRolePermission>`

**GET** `/v1/organizations/rbac_roles/{rbac_role_id}/permissions`

List the permissions an RBAC Role grants.

The RBAC Roles API is available to Claude Enterprise organizations only.

#### Parameters

- `rbacRoleID: string` (path parameter)

  ID of the RBAC Role.

- `limit?: optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

- `page?: optional string` (query parameter)

  Optionally set to the `next_page` token from the previous response.

#### Returns

- `class RBACRolePermission`

  - `"rbac_role_permission" type`

    Object type.

    For RBAC Role Permissions, this is always `"rbac_role_permission"`.

  - `string action`

    Action the permission grants on the resource.

    The vocabulary follows the resource: an `organization` grant carries a
    product-feature entitlement (for example `chat`), an admin-panel
    permission entitlement (`permission_*`), or a blanket capability-access
    mode — `capability_access_all` grants every product-feature entitlement
    except `inference_hooks_inspection`, which a role holds only through its
    own row, and `capability_access_all_ga` grants the generally-available
    subset of those as it stands at permission-check time; neither mode grants
    model-access entitlements. A consumer enumerating a role's per-feature grants should
    treat a blanket row as granting every product-feature entitlement it
    covers, or it will under-report the role's effective access. A `connector_tool` grant carries
    a tool-access action (`use` or `always_allow`); a `connector_scope` grant
    carries the scope action `grant` (the role may receive the named OAuth
    scope when tokens are minted for the connector); `connector` and
    `all_connectors` grants carry a tool-access action, the scope action, or
    an authentication-method action (`interactive` or `managed`).

  - `Resource resource`

    What the permission applies to.

    A tagged union: `type` names the kind of resource and determines which
    identifier fields are present.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->rbacRoles->permissions->list(
  'rbac_role_id', limit: 1, page: 'eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "action": "use",
      "resource": {
        "organization_id": "3c4f5e6d-7a8b-49c0-9d1e-2f3a4b5c6d7e",
        "type": "organization"
      },
      "type": "rbac_role_permission"
    }
  ],
  "has_more": true,
  "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0"
}
```