--- title: Federation url: https://platform.claude.com/docs/en/api/csharp/organization/federation --- # Federation ## Federation › Issuers ### Create Federation Issuer `FederationIssuer Organization.Federation.Issuers.Create(parameters, cancellationToken = default)` **POST** `/v1/organizations/federation_issuers` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Register an OIDC issuer that Anthropic will trust for workload identity federation in your organization. The `jwks` field controls how the issuer's signing keys are obtained and takes one of three shapes selected by `type`: `discovery` (resolve keys through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS URL), or `inline` (provide a static key set). When `jwks.type` is `discovery` and no `discovery_base` is set, the issuer URL must be publicly reachable over HTTPS so Anthropic can fetch the discovery document; for `explicit_url` and `inline` modes the issuer URL is only matched as the JWT's `iss` claim and is not fetched. #### Parameters - `IssuerCreateParams parameters` - `required string issuerUrl` The `iss` claim value to match against. minLength: 1 - `required string name` Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 - `bool? checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `Jwks jwks` How signing keys are obtained. Defaults to OIDC discovery. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonElement Type = "discovery"` - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `string? DiscoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonElement Type = "explicit_url"` - `required string Url` JWKS endpoint. minLength: 1 - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonElement Type = "inline"` - `required IReadOnlyList> Keys` Inline JWK objects. minItems: 1 - `long? maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. minimum: 1, maximum: 176400 #### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonElement Type = "federation_issuer"` - `required string ID` Tagged ID of the federation issuer. - `required DateTimeOffset? ArchivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `required bool CheckJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `required DateTimeOffset CreatedAt` When this issuer was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `required string IssuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `required Jwks Jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonElement Type = "discovery"` - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `string? DiscoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonElement Type = "explicit_url"` - `required string Url` JWKS endpoint. minLength: 1 - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonElement Type = "inline"` - `required IReadOnlyList> Keys` Inline JWK objects. minItems: 1 - `required DateTimeOffset? JwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `required long MaxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `required string Name` Admin-chosen slug identifier. - `required FederationIssuerPollStatus? PollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `required long ConsecutiveFailures` Consecutive fetch failures since the last success. - `required DateTimeOffset? LastFetchedAt` When the last successful fetch completed. format: date-time - `required DateTimeOffset? NextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `required DateTimeOffset UpdatedAt` When this issuer was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Issuers; IssuerCreateParams parameters = new() { IssuerUrl = "x", Name = "x", }; var federationIssuer = await client.Organization.Federation.Issuers.Create(parameters); Console.WriteLine(federationIssuer); ``` ##### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### List Federation Issuers `IssuerListPage Organization.Federation.Issuers.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/federation_issuers` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). List federation issuers in your organization. Archived issuers are excluded unless `include_archived=true`. #### Parameters - `IssuerListParams parameters` - `bool includeArchived` (query parameter) Include archived resources. Defaults to false. - `long limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonElement Type = "federation_issuer"` - `required string ID` Tagged ID of the federation issuer. - `required DateTimeOffset? ArchivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `required bool CheckJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `required DateTimeOffset CreatedAt` When this issuer was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `required string IssuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `required Jwks Jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonElement Type = "discovery"` - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `string? DiscoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonElement Type = "explicit_url"` - `required string Url` JWKS endpoint. minLength: 1 - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonElement Type = "inline"` - `required IReadOnlyList> Keys` Inline JWK objects. minItems: 1 - `required DateTimeOffset? JwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `required long MaxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `required string Name` Admin-chosen slug identifier. - `required FederationIssuerPollStatus? PollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `required long ConsecutiveFailures` Consecutive fetch failures since the last success. - `required DateTimeOffset? LastFetchedAt` When the last successful fetch completed. format: date-time - `required DateTimeOffset? NextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `required DateTimeOffset UpdatedAt` When this issuer was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Issuers; IssuerListParams parameters = new(); var page = await client.Organization.Federation.Issuers.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ], "next_page": "next_page" } ``` ### Get Federation Issuer `FederationIssuer Organization.Federation.Issuers.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/federation_issuers/{federation_issuer_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Retrieve a federation issuer by its ID (`fdis_...`). #### Parameters - `IssuerRetrieveParams parameters` - `required string federationIssuerID` (path parameter) ID of the federation issuer. #### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonElement Type = "federation_issuer"` - `required string ID` Tagged ID of the federation issuer. - `required DateTimeOffset? ArchivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `required bool CheckJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `required DateTimeOffset CreatedAt` When this issuer was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `required string IssuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `required Jwks Jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonElement Type = "discovery"` - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `string? DiscoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonElement Type = "explicit_url"` - `required string Url` JWKS endpoint. minLength: 1 - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonElement Type = "inline"` - `required IReadOnlyList> Keys` Inline JWK objects. minItems: 1 - `required DateTimeOffset? JwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `required long MaxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `required string Name` Admin-chosen slug identifier. - `required FederationIssuerPollStatus? PollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `required long ConsecutiveFailures` Consecutive fetch failures since the last success. - `required DateTimeOffset? LastFetchedAt` When the last successful fetch completed. format: date-time - `required DateTimeOffset? NextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `required DateTimeOffset UpdatedAt` When this issuer was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Issuers; IssuerRetrieveParams parameters = new() { FederationIssuerID = "federation_issuer_id" }; var federationIssuer = await client.Organization.Federation.Issuers.Retrieve(parameters); Console.WriteLine(federationIssuer); ``` ##### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### Update Federation Issuer `FederationIssuer Organization.Federation.Issuers.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/federation_issuers/{federation_issuer_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Partially update a federation issuer. Setting `jwks` replaces the full JWKS shape at once. Archived issuers cannot be updated; this returns 400. Create a new issuer instead. Updating an issuer that backs a rule with a scope outside `workspace:developer` or `workspace:inference` requires a Console session. #### Parameters - `IssuerUpdateParams parameters` - `required string federationIssuerID` (path parameter) ID of the federation issuer to update. - `bool? checkJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `string? issuerUrl` Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity. minLength: 1 - `Jwks? jwks` Replaces the entire JWKS configuration. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonElement Type = "discovery"` - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `string? DiscoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonElement Type = "explicit_url"` - `required string Url` JWKS endpoint. minLength: 1 - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonElement Type = "inline"` - `required IReadOnlyList> Keys` Inline JWK objects. minItems: 1 - `bool? jwksPollingDisabled` Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected. - `long? maxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. minimum: 1, maximum: 176400 - `string? name` Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 #### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonElement Type = "federation_issuer"` - `required string ID` Tagged ID of the federation issuer. - `required DateTimeOffset? ArchivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `required bool CheckJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `required DateTimeOffset CreatedAt` When this issuer was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `required string IssuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `required Jwks Jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonElement Type = "discovery"` - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `string? DiscoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonElement Type = "explicit_url"` - `required string Url` JWKS endpoint. minLength: 1 - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonElement Type = "inline"` - `required IReadOnlyList> Keys` Inline JWK objects. minItems: 1 - `required DateTimeOffset? JwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `required long MaxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `required string Name` Admin-chosen slug identifier. - `required FederationIssuerPollStatus? PollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `required long ConsecutiveFailures` Consecutive fetch failures since the last success. - `required DateTimeOffset? LastFetchedAt` When the last successful fetch completed. format: date-time - `required DateTimeOffset? NextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `required DateTimeOffset UpdatedAt` When this issuer was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Issuers; IssuerUpdateParams parameters = new() { FederationIssuerID = "federation_issuer_id" }; var federationIssuer = await client.Organization.Federation.Issuers.Update(parameters); Console.WriteLine(federationIssuer); ``` ##### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### Archive Federation Issuer `FederationIssuer Organization.Federation.Issuers.Archive(parameters, cancellationToken = default)` **POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Archive a federation issuer. Idempotent; re-archiving returns the issuer with its original `archived_at`. Rejected with 400 if any live (non-archived) federation rule still references the issuer; archive those rules first (a rule's issuer cannot be changed), or recreate them against another issuer. #### Parameters - `IssuerArchiveParams parameters` - `required string federationIssuerID` (path parameter) ID of the federation issuer to archive. #### Returns - `class FederationIssuer` Registered external OIDC identity provider. Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly. - `JsonElement Type = "federation_issuer"` - `required string ID` Tagged ID of the federation issuer. - `required DateTimeOffset? ArchivedAt` If set, all rules referencing this issuer reject token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `required bool CheckJti` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `required DateTimeOffset CreatedAt` When this issuer was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `required string IssuerUrl` The `iss` claim value. Incoming JWTs must match exactly. - `required Jwks Jwks` How signing keys are obtained for signature verification. - `class JwksDiscovery` JWKS via the issuer's OIDC discovery document. - `JsonElement Type = "discovery"` - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `string? DiscoveryBase` Set when the discovery URL differs from `issuer_url`. - `class JwksExplicitUrl` JWKS fetched from a fixed endpoint. - `JsonElement Type = "explicit_url"` - `required string Url` JWKS endpoint. minLength: 1 - `string? CACertPem` Optional custom CA (PEM) for TLS verification of the JWKS fetch. maxLength: 8192 - `class JwksInline` JWKS supplied directly; no network fetch. - `JsonElement Type = "inline"` - `required IReadOnlyList> Keys` Inline JWK objects. minItems: 1 - `required DateTimeOffset? JwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. format: date-time - `required long MaxJwtLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `required string Name` Admin-chosen slug identifier. - `required FederationIssuerPollStatus? PollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `required long ConsecutiveFailures` Consecutive fetch failures since the last success. - `required DateTimeOffset? LastFetchedAt` When the last successful fetch completed. format: date-time - `required DateTimeOffset? NextPollAt` When the next fetch is scheduled. Null if paused. format: date-time - `required DateTimeOffset UpdatedAt` When this issuer was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Issuers; IssuerArchiveParams parameters = new() { FederationIssuerID = "federation_issuer_id" }; var federationIssuer = await client.Organization.Federation.Issuers.Archive(parameters); Console.WriteLine(federationIssuer); ``` ##### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Federation › Rules ### Create Federation Rule `FederationRule Organization.Federation.Rules.Create(parameters, cancellationToken = default)` **POST** `/v1/organizations/federation_rules` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Create a federation rule owned by your organization. The referenced issuer and the target service account must already exist in the same organization; invalid references are rejected with a 400 error. The workspace reference is validated. Membership is not checked at rule creation: token exchange resolves a single enabled workspace per call and is rejected unless the target service account is a member of that workspace (it is implicitly a member of the default workspace). Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) must constrain tenant identity via an identity-bearing claim, a tenant-pinning subject prefix (such as `repo:YOUR_ORG/...`), or a CEL condition referencing one of those identity claims (e.g. `claims.repository_owner`). OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `RuleCreateParams parameters` - `required string issuerID` Tagged ID of the federation issuer. - `required FederationRuleMatch match` Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient. - `required string name` Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 - `required string oauthScope` Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session. minLength: 1 - `required ServiceAccountTarget target` Identity that tokens minted via this rule act as. Currently always a `service_account` target. - `bool appliesToAllWorkspaces` When true, enable this rule for every workspace in the org (including workspaces created later). - `string? description` Optional free-text description. maxLength: 2000 - `long tokenLifetimeSeconds` Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. minimum: 60, maximum: 86400 - `string? workspaceID` Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource. #### Returns - `class FederationRule` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via `workspace_ids` or `applies_to_all_workspaces`, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy `workspace_id` binding do not enforce this. - `JsonElement Type = "federation_rule"` - `required string ID` Tagged ID of the federation rule. - `required bool AppliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `required DateTimeOffset? ArchivedAt` If set, this rule is archived and rejects token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `required DateTimeOffset CreatedAt` When this rule was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `required string? Description` Optional free-text description. - `required string IssuerID` Tagged ID of the issuer whose tokens this rule accepts. - `required string? IssuerName` Issuer's display name at read time. - `required FederationRuleMatch Match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string? Audience` Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. maxLength: 1024 - `IReadOnlyDictionary? Claims` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims. - `string? Condition` CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. maxLength: 4096 - `string? SubjectPrefix` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. maxLength: 1024 - `required string Name` Admin-chosen slug identifier. - `required string OAuthScope` Space-separated OAuth scopes granted on the minted token. - `required ServiceAccountTarget Target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `JsonElement Type = "service_account"` - `required string ServiceAccountID` Tagged ID of the service account to mint tokens for. - `string? ServiceAccountName` Service account's display name at read time. Ignored on writes. - `required long TokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `required DateTimeOffset UpdatedAt` When this rule was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `required IReadOnlyList WorkspaceIds` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```csharp using System; using System.Collections.Generic; using Anthropic.Models.Organization.Federation.Rules; RuleCreateParams parameters = new() { IssuerID = "issuer_id", Match = new() { Audience = "audience", Claims = new Dictionary() { { "foo", "string" } }, Condition = "condition", SubjectPrefix = "subject_prefix", }, Name = "x", OAuthScope = "x", Target = new() { ServiceAccountID = "svac_01SDCCSbTxrXDpWc1phhtcfK", ServiceAccountName = "service_account_name", }, }; var federationRule = await client.Organization.Federation.Rules.Create(parameters); Console.WriteLine(federationRule); ``` ##### Response (200) ```json { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ``` ### List Federation Rules `RuleListPage Organization.Federation.Rules.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/federation_rules` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). List federation rules in your organization. Optionally filter by issuer with `issuer_id`. Archived rules are excluded unless `include_archived=true`. #### Parameters - `RuleListParams parameters` - `bool includeArchived` (query parameter) Include archived resources. Defaults to false. - `string? issuerID` (query parameter) Filter to rules referencing this federation issuer. - `long limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class FederationRule` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via `workspace_ids` or `applies_to_all_workspaces`, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy `workspace_id` binding do not enforce this. - `JsonElement Type = "federation_rule"` - `required string ID` Tagged ID of the federation rule. - `required bool AppliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `required DateTimeOffset? ArchivedAt` If set, this rule is archived and rejects token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `required DateTimeOffset CreatedAt` When this rule was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `required string? Description` Optional free-text description. - `required string IssuerID` Tagged ID of the issuer whose tokens this rule accepts. - `required string? IssuerName` Issuer's display name at read time. - `required FederationRuleMatch Match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string? Audience` Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. maxLength: 1024 - `IReadOnlyDictionary? Claims` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims. - `string? Condition` CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. maxLength: 4096 - `string? SubjectPrefix` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. maxLength: 1024 - `required string Name` Admin-chosen slug identifier. - `required string OAuthScope` Space-separated OAuth scopes granted on the minted token. - `required ServiceAccountTarget Target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `JsonElement Type = "service_account"` - `required string ServiceAccountID` Tagged ID of the service account to mint tokens for. - `string? ServiceAccountName` Service account's display name at read time. Ignored on writes. - `required long TokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `required DateTimeOffset UpdatedAt` When this rule was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `required IReadOnlyList WorkspaceIds` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Rules; RuleListParams parameters = new(); var page = await client.Organization.Federation.Rules.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ], "next_page": "next_page" } ``` ### Get Federation Rule `FederationRule Organization.Federation.Rules.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/federation_rules/{federation_rule_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Retrieve a federation rule by its ID (`fdrl_...`). #### Parameters - `RuleRetrieveParams parameters` - `required string federationRuleID` (path parameter) ID of the federation rule. #### Returns - `class FederationRule` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via `workspace_ids` or `applies_to_all_workspaces`, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy `workspace_id` binding do not enforce this. - `JsonElement Type = "federation_rule"` - `required string ID` Tagged ID of the federation rule. - `required bool AppliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `required DateTimeOffset? ArchivedAt` If set, this rule is archived and rejects token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `required DateTimeOffset CreatedAt` When this rule was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `required string? Description` Optional free-text description. - `required string IssuerID` Tagged ID of the issuer whose tokens this rule accepts. - `required string? IssuerName` Issuer's display name at read time. - `required FederationRuleMatch Match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string? Audience` Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. maxLength: 1024 - `IReadOnlyDictionary? Claims` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims. - `string? Condition` CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. maxLength: 4096 - `string? SubjectPrefix` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. maxLength: 1024 - `required string Name` Admin-chosen slug identifier. - `required string OAuthScope` Space-separated OAuth scopes granted on the minted token. - `required ServiceAccountTarget Target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `JsonElement Type = "service_account"` - `required string ServiceAccountID` Tagged ID of the service account to mint tokens for. - `string? ServiceAccountName` Service account's display name at read time. Ignored on writes. - `required long TokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `required DateTimeOffset UpdatedAt` When this rule was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `required IReadOnlyList WorkspaceIds` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Rules; RuleRetrieveParams parameters = new() { FederationRuleID = "federation_rule_id" }; var federationRule = await client.Organization.Federation.Rules.Retrieve(parameters); Console.WriteLine(federationRule); ``` ##### Response (200) ```json { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ``` ### Update Federation Rule `FederationRule Organization.Federation.Rules.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/federation_rules/{federation_rule_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Partially update a federation rule. `issuer_id` is immutable. `match` and `target` are replaced as whole objects when set. Referenced service accounts and workspaces must exist in your organization; invalid references are rejected with a 400 error. Archived rules cannot be updated; this returns 400. Create a new rule instead. Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) must constrain tenant identity via an identity-bearing claim, a tenant-pinning subject prefix (such as `repo:YOUR_ORG/...`), or a CEL condition referencing one of those identity claims (e.g. `claims.repository_owner`). On these issuers the requirement is re-checked on every update; if an existing rule's stored match does not yet constrain tenant identity, any update (even a rename or description change) must also supply a conforming `match` in the same request. OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `RuleUpdateParams parameters` - `required string federationRuleID` (path parameter) ID of the federation rule to update. - `bool? appliesToAllWorkspaces` When true, enables this rule for every workspace in the org (including workspaces created later). Setting `false` is rejected with 400 if no workspace would remain enabled; a rule with only a legacy `workspace_id` binding continues to mint. - `string? description` Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string). maxLength: 2000 - `FederationRuleMatch? match` Replaces the entire match object. All populated matcher fields must pass. - `string? name` Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 - `string? oauthScope` Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session. minLength: 1 - `ServiceAccountTarget? target` Replaces the entire target object. Currently always a `service_account` target. - `long? tokenLifetimeSeconds` Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. minimum: 60, maximum: 86400 - `string? workspaceID` Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead. #### Returns - `class FederationRule` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via `workspace_ids` or `applies_to_all_workspaces`, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy `workspace_id` binding do not enforce this. - `JsonElement Type = "federation_rule"` - `required string ID` Tagged ID of the federation rule. - `required bool AppliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `required DateTimeOffset? ArchivedAt` If set, this rule is archived and rejects token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `required DateTimeOffset CreatedAt` When this rule was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `required string? Description` Optional free-text description. - `required string IssuerID` Tagged ID of the issuer whose tokens this rule accepts. - `required string? IssuerName` Issuer's display name at read time. - `required FederationRuleMatch Match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string? Audience` Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. maxLength: 1024 - `IReadOnlyDictionary? Claims` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims. - `string? Condition` CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. maxLength: 4096 - `string? SubjectPrefix` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. maxLength: 1024 - `required string Name` Admin-chosen slug identifier. - `required string OAuthScope` Space-separated OAuth scopes granted on the minted token. - `required ServiceAccountTarget Target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `JsonElement Type = "service_account"` - `required string ServiceAccountID` Tagged ID of the service account to mint tokens for. - `string? ServiceAccountName` Service account's display name at read time. Ignored on writes. - `required long TokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `required DateTimeOffset UpdatedAt` When this rule was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `required IReadOnlyList WorkspaceIds` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Rules; RuleUpdateParams parameters = new() { FederationRuleID = "federation_rule_id" }; var federationRule = await client.Organization.Federation.Rules.Update(parameters); Console.WriteLine(federationRule); ``` ##### Response (200) ```json { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ``` ### Archive Federation Rule `FederationRule Organization.Federation.Rules.Archive(parameters, cancellationToken = default)` **POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Archive a federation rule. Token exchange through this rule stops immediately. Idempotent; re-archiving returns the rule with its original `archived_at`. Archiving clears the rule's workspace targeting (`workspace_id` and `workspace_ids` are emptied). Tokens already minted before archive remain valid until they expire. OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `RuleArchiveParams parameters` - `required string federationRuleID` (path parameter) ID of the federation rule to archive. #### Returns - `class FederationRule` Authorization rule binding an external OIDC identity to Anthropic. Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via `workspace_ids` or `applies_to_all_workspaces`, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy `workspace_id` binding do not enforce this. - `JsonElement Type = "federation_rule"` - `required string ID` Tagged ID of the federation rule. - `required bool AppliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `required DateTimeOffset? ArchivedAt` If set, this rule is archived and rejects token exchange. format: date-time - `required string? ArchivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `required DateTimeOffset CreatedAt` When this rule was created. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `required string? Description` Optional free-text description. - `required string IssuerID` Tagged ID of the issuer whose tokens this rule accepts. - `required string? IssuerName` Issuer's display name at read time. - `required FederationRuleMatch Match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string? Audience` Exact match against the `aud` claim (any element if array). When omitted, the JWT's `aud` must still equal Anthropic's expected audience for the issuer; setting this field overrides that default. maxLength: 1024 - `IReadOnlyDictionary? Claims` Exact-match `{claim: value}` pairs against top-level claims. Only string-valued claims can be matched; use `condition` for non-string claims. - `string? Condition` CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the `claims` variable; a constant-true expression (such as `true`) is rejected with 400. maxLength: 4096 - `string? SubjectPrefix` Match the verified JWT `sub` claim. Exact match unless the value ends with `*`, in which case it is a prefix match. Example: `repo:my-org/my-repo:ref:refs/heads/main`. maxLength: 1024 - `required string Name` Admin-chosen slug identifier. - `required string OAuthScope` Space-separated OAuth scopes granted on the minted token. - `required ServiceAccountTarget Target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `JsonElement Type = "service_account"` - `required string ServiceAccountID` Tagged ID of the service account to mint tokens for. - `string? ServiceAccountName` Service account's display name at read time. Ignored on writes. - `required long TokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `required DateTimeOffset UpdatedAt` When this rule was last updated. format: date-time - `required string? UpdatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `required IReadOnlyList WorkspaceIds` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Rules; RuleArchiveParams parameters = new() { FederationRuleID = "federation_rule_id" }; var federationRule = await client.Organization.Federation.Rules.Archive(parameters); Console.WriteLine(federationRule); ``` ##### Response (200) ```json { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ``` ## Federation › Rules › Workspaces ### Add Federation Rule Workspace `FederationRuleWorkspace Organization.Federation.Rules.Workspaces.Add(parameters, cancellationToken = default)` **POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Enable a federation rule for a workspace. Idempotent; re-enabling returns the existing enablement. The rule and workspace must both belong to your organization. Membership of the rule's target service account in this workspace is not checked at enablement: token exchange into this workspace is rejected unless the target is a member (it is implicitly a member of the default workspace). Archived rules are rejected with 400. OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `WorkspaceAddParams parameters` - `required string federationRuleID` (path parameter) ID of the federation rule. - `required string workspaceID` Tagged ID of the workspace to enable this rule for. #### Returns - `class FederationRuleWorkspace` - `JsonElement Type = "federation_rule_workspace"` - `required DateTimeOffset CreatedAt` When this workspace was enabled for the rule. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known. - `required string FederationRuleID` Tagged ID of the federation rule. - `required string WorkspaceID` Tagged ID of the workspace this rule is enabled for. - `required string? WorkspaceName` Workspace display name. Populated when listing; null in the enable response. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Rules.Workspaces; WorkspaceAddParams parameters = new() { FederationRuleID = "federation_rule_id", WorkspaceID = "workspace_id", }; var federationRuleWorkspace = await client.Organization.Federation.Rules.Workspaces.Add(parameters); Console.WriteLine(federationRuleWorkspace); ``` ##### Response (200) ```json { "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "federation_rule_id": "federation_rule_id", "type": "federation_rule_workspace", "workspace_id": "workspace_id", "workspace_name": "workspace_name" } ``` ### List Federation Rule Workspaces `WorkspaceListPage Organization.Federation.Rules.Workspaces.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). List workspaces where this federation rule is enabled. Returns all workspace enablements in a single response; the `limit` and `page` parameters are accepted but have no effect, and `next_page` is always `null`. Returns explicit per-workspace enablements only; for rules with `applies_to_all_workspaces` or a legacy single `workspace_id`, check those fields on the rule itself. #### Parameters - `WorkspaceListParams parameters` - `required string federationRuleID` (path parameter) ID of the federation rule. - `long limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class FederationRuleWorkspace` - `JsonElement Type = "federation_rule_workspace"` - `required DateTimeOffset CreatedAt` When this workspace was enabled for the rule. format: date-time - `required string? CreatedByActorID` Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known. - `required string FederationRuleID` Tagged ID of the federation rule. - `required string WorkspaceID` Tagged ID of the workspace this rule is enabled for. - `required string? WorkspaceName` Workspace display name. Populated when listing; null in the enable response. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Rules.Workspaces; WorkspaceListParams parameters = new() { FederationRuleID = "federation_rule_id" }; var page = await client.Organization.Federation.Rules.Workspaces.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "federation_rule_id": "federation_rule_id", "type": "federation_rule_workspace", "workspace_id": "workspace_id", "workspace_name": "workspace_name" } ], "next_page": "next_page" } ``` ### Remove Federation Rule Workspace `WorkspaceRemoveResponse Organization.Federation.Rules.Workspaces.Remove(parameters, cancellationToken = default)` **DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Disable a federation rule for a workspace. Idempotent; succeeds even if the enablement was already removed. OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `WorkspaceRemoveParams parameters` - `required string federationRuleID` (path parameter) ID of the federation rule. - `required string workspaceID` (path parameter) ID of the workspace to disable for. #### Returns - `class WorkspaceRemoveResponse` - `JsonElement Type = "federation_rule_workspace_deleted"` - `required string FederationRuleID` Tagged ID of the federation rule. - `required string WorkspaceID` Tagged ID of the workspace named in the delete request. Removal is idempotent. #### Example ```csharp using System; using Anthropic.Models.Organization.Federation.Rules.Workspaces; WorkspaceRemoveParams parameters = new() { FederationRuleID = "federation_rule_id", WorkspaceID = "workspace_id", }; var workspace = await client.Organization.Federation.Rules.Workspaces.Remove(parameters); Console.WriteLine(workspace); ``` ##### Response (200) ```json { "federation_rule_id": "federation_rule_id", "type": "federation_rule_workspace_deleted", "workspace_id": "workspace_id" } ```