Organization

Retrieve information about the organization associated with the authenticated API key.

Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to API keys in the Claude Console.

Create an external key config owned by the caller's organization.

List external key configs in the caller's organization.

Retrieve a single external key config in the caller's organization by ID.

Partially update an external key config. Omitted fields are left unchanged.

Delete an external key config.

Validate an external key config against the customer's KMS.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Invite a user to join the organization by email.

List the organization's invites.

Retrieve an invite by ID.

Delete a pending invite.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

List the organization's members.

Retrieve a member of the organization by user ID.

Update a member's organization role.

Remove a member from the organization.

List a workspace's rate limits.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

List Messages API rate limits for your organization.

Retrieve your organization's Compliance Settings.

Update your organization's Compliance Settings.

Retrieve daily aggregated usage metrics for Claude Code users. Enables organizations to analyze developer productivity and build custom dashboards.

Get organization-wide activity summaries for a date range.

Get per-user activity for a given day, with cursor-based pagination.

Get per-project activity for a given day, with cursor-based pagination.

Get per-connector usage for a given day, with cursor-based pagination.

Get per-plugin install + invocation usage for a given day, with pagination.

Get per-skill usage for a given day, with cursor-based pagination.

Get artifact-creation activity for a given day, broken out by MIME type.

Get token usage over time across a date range.

Get per-user token usage across a date range.

Get cost in USD over time across a date range.

Get per-user cost in USD across a date range.

Set a spend limit.

Retrieve a spend limit by ID.

Delete a spend limit.

List the organization's spend limits.

List each member's effective spend limit and period-to-date spend.

List spend limit increase requests, most recent first.

Retrieve a spend limit increase request.

Approve a pending spend limit increase request.

Deny a pending spend limit increase request.

Create an RBAC Group in the Claude Enterprise tenant. Groups created via the API have source type "direct".

List RBAC Groups in the Claude Enterprise tenant.

Retrieve an RBAC Group by ID.

Update an RBAC Group's name. Groups provisioned by an identity provider (source type "scim") cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

Delete an RBAC Group. Groups provisioned by an identity provider (source type "scim") cannot be deleted via the API while an organization in the tenant uses SCIM provisioning.

List members of an RBAC Group.

Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type "scim") cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type "scim") cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

List RBAC Roles in the organization.

Retrieve an RBAC Role by ID.

List the permissions an RBAC Role grants.

Create an organization-owned Plugin and its first version by uploading the version's files.

Retrieve a Plugin by ID.

Change which stored version of an organization-owned Plugin is served to members, for example to roll back to an earlier one. This pins the served version: later uploads are stored but no longer change what is served, and pinning cannot currently be undone, here or in claude.ai.

List the Plugins created under the organization, newest first: those in the organization's own plugin marketplaces and those in members' personal plugin marketplaces.

Permanently delete a Plugin and every version it holds, exactly as when an administrator deletes it in claude.ai. The Plugin may belong to the organization or to a member, including a member who has since left the organization.

Add a version to an organization-owned Plugin by uploading the new version's files; it becomes the version served to members unless the Plugin's served version has been pinned.

List a Plugin's versions, newest first.

Retrieve one version of a Plugin by its ID, or the Plugin's newest version.

Download one version's .zip archive, exactly as stored. Each download of a Plugin from a member's personal plugin marketplace is recorded on the Compliance API activity feed.

List an organization-owned Plugin's installation settings, which say which members it is for, most recently created first.

Set or change an organization-owned Plugin's installation setting for the whole organization or for one RBAC Group.

Remove an organization-owned Plugin's own installation setting for the whole organization or for one RBAC Group.

List the shares the owner of a member-owned Plugin has given — to every member of the organization, to an RBAC Group, or to one member — most recently granted first.

List the plugin marketplaces Plugins live in, newest first: the organization's own and its members' personal ones.

Retrieve a plugin marketplace by ID.

Set the default installation setting of one of the organization's own plugin marketplaces. Every Plugin in it without a setting of its own gets this default as its organization-wide setting, including Plugins added later.

Check whether a plugin marketplace held in a public GitHub repository would synchronize into claude.ai, without connecting or storing it.

Check whether a plugin marketplace, uploaded as a .zip of the marketplace directory, would synchronize into claude.ai, without connecting or storing it.