--- title: Workspaces url: https://platform.claude.com/docs/en/api/csharp/organization/workspaces --- # Workspaces ## List Workspaces `WorkspaceListPage Organization.Workspaces.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/workspaces` List Workspaces ### Parameters - `WorkspaceListParams parameters` - `string afterID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `string beforeID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `bool includeArchived` (query parameter) Whether to include Workspaces that have been archived in the response - `bool includeDefault` (query parameter) Whether to include the organization's default Workspace in the response - `long limit` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 ### Returns - `class Workspace` - `JsonElement Type = "workspace"` Object type. For Workspaces, this is always `"workspace"`. - `required string ID` ID of the Workspace. - `required DateTimeOffset? ArchivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `required string CompartmentID` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `required DataResidency DataResidency` Data residency configuration. - `required AllowedInferenceGeos AllowedInferenceGeos` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `IReadOnlyList` - `Global("global")` - `Us("us")` - `class Unrestricted:` - `required DefaultInferenceGeo DefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `Global("global")` - `Us("us")` - `required WorkspaceGeo WorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `required string DisplayColor` Hex color code representing the Workspace in the Anthropic Console. - `required string? ExternalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `required string Name` Name of the Workspace. - `required IReadOnlyDictionary Tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; WorkspaceListParams parameters = new(); var page = await client.Organization.Workspaces.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` #### Response (200) ```json { "data": [ { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ## Create Workspace `Workspace Organization.Workspaces.Create(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces` Create Workspace ### Parameters - `WorkspaceCreateParams parameters` - `required string name` Name of the Workspace. minLength: 1, maxLength: 255 - `DataResidencyCreateConfig? dataResidency` Data residency configuration for the workspace. If omitted, defaults to `workspace_geo: "us"`, `allowed_inference_geos: "unrestricted"`, and `default_inference_geo: "global"`. - `string? displayColor` Hex color code representing the Workspace in the Anthropic Console. maxLength: 7, pattern: ^#[0-9A-Fa-f]{6}$ - `string? externalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `IReadOnlyDictionary? tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Returns - `class Workspace` - `JsonElement Type = "workspace"` Object type. For Workspaces, this is always `"workspace"`. - `required string ID` ID of the Workspace. - `required DateTimeOffset? ArchivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `required string CompartmentID` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `required DataResidency DataResidency` Data residency configuration. - `required AllowedInferenceGeos AllowedInferenceGeos` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `IReadOnlyList` - `Global("global")` - `Us("us")` - `class Unrestricted:` - `required DefaultInferenceGeo DefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `Global("global")` - `Us("us")` - `required WorkspaceGeo WorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `required string DisplayColor` Hex color code representing the Workspace in the Anthropic Console. - `required string? ExternalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `required string Name` Name of the Workspace. - `required IReadOnlyDictionary Tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; WorkspaceCreateParams parameters = new() { Name = "x" }; var workspace = await client.Organization.Workspaces.Create(parameters); Console.WriteLine(workspace); ``` #### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ``` ## Get Workspace `Workspace Organization.Workspaces.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/workspaces/{workspace_id}` Get Workspace ### Parameters - `WorkspaceRetrieveParams parameters` - `required string workspaceID` (path parameter) ID of the Workspace. ### Returns - `class Workspace` - `JsonElement Type = "workspace"` Object type. For Workspaces, this is always `"workspace"`. - `required string ID` ID of the Workspace. - `required DateTimeOffset? ArchivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `required string CompartmentID` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `required DataResidency DataResidency` Data residency configuration. - `required AllowedInferenceGeos AllowedInferenceGeos` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `IReadOnlyList` - `Global("global")` - `Us("us")` - `class Unrestricted:` - `required DefaultInferenceGeo DefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `Global("global")` - `Us("us")` - `required WorkspaceGeo WorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `required string DisplayColor` Hex color code representing the Workspace in the Anthropic Console. - `required string? ExternalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `required string Name` Name of the Workspace. - `required IReadOnlyDictionary Tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; WorkspaceRetrieveParams parameters = new() { WorkspaceID = "workspace_id" }; var workspace = await client.Organization.Workspaces.Retrieve(parameters); Console.WriteLine(workspace); ``` #### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ``` ## Update Workspace `Workspace Organization.Workspaces.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces/{workspace_id}` Update Workspace ### Parameters - `WorkspaceUpdateParams parameters` - `required string workspaceID` (path parameter) - `DataResidencyUpdateConfig? dataResidency` Data residency configuration for the workspace. - `string displayColor` Hex color code representing the Workspace in the Anthropic Console. maxLength: 7, pattern: ^#[0-9A-Fa-f]{6}$ - `string externalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `string name` Name of the Workspace. minLength: 1, maxLength: 255 - `IReadOnlyDictionary? tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Returns - `class Workspace` - `JsonElement Type = "workspace"` Object type. For Workspaces, this is always `"workspace"`. - `required string ID` ID of the Workspace. - `required DateTimeOffset? ArchivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `required string CompartmentID` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `required DataResidency DataResidency` Data residency configuration. - `required AllowedInferenceGeos AllowedInferenceGeos` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `IReadOnlyList` - `Global("global")` - `Us("us")` - `class Unrestricted:` - `required DefaultInferenceGeo DefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `Global("global")` - `Us("us")` - `required WorkspaceGeo WorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `required string DisplayColor` Hex color code representing the Workspace in the Anthropic Console. - `required string? ExternalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `required string Name` Name of the Workspace. - `required IReadOnlyDictionary Tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; WorkspaceUpdateParams parameters = new() { WorkspaceID = "workspace_id" }; var workspace = await client.Organization.Workspaces.Update(parameters); Console.WriteLine(workspace); ``` #### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ``` ## Archive Workspace `Workspace Organization.Workspaces.Archive(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces/{workspace_id}/archive` Archive Workspace ### Parameters - `WorkspaceArchiveParams parameters` - `required string workspaceID` (path parameter) ### Returns - `class Workspace` - `JsonElement Type = "workspace"` Object type. For Workspaces, this is always `"workspace"`. - `required string ID` ID of the Workspace. - `required DateTimeOffset? ArchivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `required string CompartmentID` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `required DataResidency DataResidency` Data residency configuration. - `required AllowedInferenceGeos AllowedInferenceGeos` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `IReadOnlyList` - `Global("global")` - `Us("us")` - `class Unrestricted:` - `required DefaultInferenceGeo DefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `Global("global")` - `Us("us")` - `required WorkspaceGeo WorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `required string DisplayColor` Hex color code representing the Workspace in the Anthropic Console. - `required string? ExternalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `required string Name` Name of the Workspace. - `required IReadOnlyDictionary Tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; WorkspaceArchiveParams parameters = new() { WorkspaceID = "workspace_id" }; var workspace = await client.Organization.Workspaces.Archive(parameters); Console.WriteLine(workspace); ``` #### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ``` ## Domain types ### Allowed Inference Geo - `enum AllowedInferenceGeo` - `Global("global")` - `Us("us")` ### Data Residency - `class DataResidency` - `required AllowedInferenceGeos AllowedInferenceGeos` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `IReadOnlyList` - `Global("global")` - `Us("us")` - `class Unrestricted:` - `required DefaultInferenceGeo DefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `Global("global")` - `Us("us")` - `required WorkspaceGeo WorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. ### Data Residency Create Config - `class DataResidencyCreateConfig` - `AllowedInferenceGeos? AllowedInferenceGeos` Permitted inference geo values. Defaults to 'unrestricted' if omitted, which allows all geos. Use the string 'unrestricted' to allow all geos, or a list of specific geos. - `IReadOnlyList` - `Global("global")` - `Us("us")` - `class Unrestricted:` - `DefaultInferenceGeo? DefaultInferenceGeo` Default inference geo applied when requests omit the parameter. Defaults to 'global' if omitted. Must be a member of `allowed_inference_geos` unless `allowed_inference_geos` is `"unrestricted"`. - `Global("global")` - `Us("us")` - `WorkspaceGeo? WorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. Defaults to 'us' if omitted. ### Data Residency Update Config - `class DataResidencyUpdateConfig` - `AllowedInferenceGeos? AllowedInferenceGeos` Permitted inference geo values. Use 'unrestricted' to allow all geos, or a list of specific geos. - `IReadOnlyList` - `Global("global")` - `Us("us")` - `class Unrestricted:` - `DefaultInferenceGeo? DefaultInferenceGeo` Default inference geo applied when requests omit the parameter. Must be a member of `allowed_inference_geos` unless `allowed_inference_geos` is `"unrestricted"`. - `Global("global")` - `Us("us")` ### No Billing Workspace Role - `enum NoBillingWorkspaceRole` - `WorkspaceAdmin("workspace_admin")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` ### Workspace - `class Workspace` - `JsonElement Type = "workspace"` Object type. For Workspaces, this is always `"workspace"`. - `required string ID` ID of the Workspace. - `required DateTimeOffset? ArchivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `required string CompartmentID` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `required DateTimeOffset CreatedAt` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `required DataResidency DataResidency` Data residency configuration. - `required AllowedInferenceGeos AllowedInferenceGeos` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `IReadOnlyList` - `Global("global")` - `Us("us")` - `class Unrestricted:` - `required DefaultInferenceGeo DefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `Global("global")` - `Us("us")` - `required WorkspaceGeo WorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `required string DisplayColor` Hex color code representing the Workspace in the Anthropic Console. - `required string? ExternalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `required string Name` Name of the Workspace. - `required IReadOnlyDictionary Tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Workspace Member - `class WorkspaceMember` - `JsonElement Type = "workspace_member"` Object type. For Workspace Members, this is always `"workspace_member"`. - `required string UserID` ID of the User. - `required string WorkspaceID` ID of the Workspace. - `required WorkspaceRole WorkspaceRole` Role of the Workspace Member. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` ### Workspace Role - `enum WorkspaceRole` - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` ## Workspaces › Rate Limits ### List Workspace Rate Limits `RateLimitListPage Organization.Workspaces.RateLimits.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/workspaces/{workspace_id}/rate_limits` List a workspace's rate limits. By default, returns only the groups and limiter types that have a workspace-level override. With `include_inherited=true`, returns every group with organization-level limits the workspace can see, listing for each the values it inherits from the organization as well as its own overrides. Each value's `source` says which it is. When `limit` is omitted, every matching entry is returned in a single page; when `limit` truncates the result, follow `next_page` to fetch the remaining entries. #### Parameters - `RateLimitListParams parameters` - `required string workspaceID` (path parameter) The ID of the workspace. - `GroupType? groupType` (query parameter) Filter by group type. - `Batch("batch")` - `Files("files")` - `ModelGroup("model_group")` - `Skills("skills")` - `TokenCount("token_count")` - `WebSearch("web_search")` - `bool includeInherited` (query parameter) Also list the limiter values the workspace inherits from the organization, including groups with no workspace-level override. - `long? limit` (query parameter) Maximum number of items to return per page. Ranges from `1` to `1000`. When omitted, every remaining entry is returned in a single page and `next_page` is `null`. minimum: 1, maximum: 1000 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class WorkspaceRateLimit` - `JsonElement Type = "workspace_rate_limit"` Object type. Always `workspace_rate_limit` for workspace rate-limit entries. - `required Group Group` The rate-limit group this entry's limits apply to. - `class OrganizationRateLimitModelGroup` - `JsonElement Type = "model_group"` Always `model_group`: a family of models. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `required string DisplayName` Human-readable name of the model group (for example, `Claude Sonnet 4.x`). For display only; it may change. - `class OrganizationRateLimitBatchGroup` - `JsonElement Type = "batch"` Always `batch`: the Message Batches API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitTokenCountGroup` - `JsonElement Type = "token_count"` Always `token_count`: the Token Count API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitFilesGroup` - `JsonElement Type = "files"` Always `files`: the Files API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitSkillsGroup` - `JsonElement Type = "skills"` Always `skills`: the Skills API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitWebSearchGroup` - `JsonElement Type = "web_search"` Always `web_search`: the Messages API web search tool. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `required IReadOnlyList Limits` The workspace's limiter values for this group. By default only the limiter types with a workspace-level override are listed. With `include_inherited` set to `true`, the limiter types the workspace inherits from the organization are listed too, each marked by `source`. - `required string Type` The limiter type (for example, `requests_per_minute` or `input_tokens_per_minute`). - `required long? OrgLimit` The organization-level value for the same limiter type, for reference. `null` when the organization has no limit configured for this limiter type. - `required Source Source` Where `value` comes from. `organization` values are listed only when `include_inherited` is `true`, and then `value` equals `org_limit`. - `class WorkspaceRateLimitWorkspaceSource` - `JsonElement Type = "workspace"` Always `workspace`: a workspace-level override is stored. - `class WorkspaceRateLimitOrganizationSource` - `JsonElement Type = "organization"` Always `organization`: no workspace-level override is stored, so the organization's value applies. - `required long Value` The workspace's value for this limiter type: the workspace-level override when `source.type` is `workspace`, otherwise the organization's value. - `required IReadOnlyList? Models` Model names this entry's limits apply to, including aliases. `null` when `group.type` is not `"model_group"`. The list covers the models this workspace has access to, so it can differ between workspaces. - `required string RateLimitID` The `id` of the organization's RateLimit entry this entry applies to. - `required string WorkspaceID` ID of the Workspace this entry applies to. #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.RateLimits; RateLimitListParams parameters = new() { WorkspaceID = "workspace_id" }; var page = await client.Organization.Workspaces.RateLimits.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "group": { "id": "id", "display_name": "display_name", "type": "model_group" }, "limits": [ { "org_limit": 0, "source": { "type": "workspace" }, "type": "type", "value": 0 } ], "models": [ "string" ], "rate_limit_id": "rate_limit_id", "type": "workspace_rate_limit", "workspace_id": "workspace_id" } ], "next_page": "next_page" } ``` ### Set Workspace Rate Limits `WorkspaceRateLimit Organization.Workspaces.RateLimits.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces/{workspace_id}/rate_limits/{rate_limit_id}` Set or clear rate-limit overrides for one rate-limit group in a workspace. Only the limiter types named in `limits` change: an integer `value` sets that type's override and `null` clears it. Types not named keep their current value. A value above the organization's own limit is stored, but the organization limit still applies, so the lower of the two is enforced. Returns the targeted group's entry with this request applied, in the shape `GET /v1/organizations/workspaces/{workspace_id}/rate_limits` returns. Changes take effect within about an hour. #### Parameters - `RateLimitUpdateParams parameters` - `required string workspaceID` (path parameter) The ID of the workspace. - `required string rateLimitID` (path parameter) The `id` of the organization's rate-limit entry to set overrides for. - `required IReadOnlyList limits` Limits to set or clear. Unspecified limit types are unchanged. minItems: 1, maxItems: 16 - `required WorkspaceRateLimitType Type` Rate limiter type. - `FastItpmca("fast_itpmca")` - `FastOtpm("fast_otpm")` - `InputTokensPerMinute("input_tokens_per_minute")` - `InputTokensPerMinuteCacheAware("input_tokens_per_minute_cache_aware")` - `OutputTokensPerMinute("output_tokens_per_minute")` - `RequestsPerMinute("requests_per_minute")` - `TokensPerDay("tokens_per_day")` - `TokensPerMinute("tokens_per_minute")` - `ToolUsesPerSecond("tool_uses_per_second")` - `required long? Value` New limit value. Set to null to clear the workspace override and fall back to the organization limit. minimum: 0, maximum: 9007199254740991 #### Returns - `class WorkspaceRateLimit` - `JsonElement Type = "workspace_rate_limit"` Object type. Always `workspace_rate_limit` for workspace rate-limit entries. - `required Group Group` The rate-limit group this entry's limits apply to. - `class OrganizationRateLimitModelGroup` - `JsonElement Type = "model_group"` Always `model_group`: a family of models. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `required string DisplayName` Human-readable name of the model group (for example, `Claude Sonnet 4.x`). For display only; it may change. - `class OrganizationRateLimitBatchGroup` - `JsonElement Type = "batch"` Always `batch`: the Message Batches API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitTokenCountGroup` - `JsonElement Type = "token_count"` Always `token_count`: the Token Count API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitFilesGroup` - `JsonElement Type = "files"` Always `files`: the Files API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitSkillsGroup` - `JsonElement Type = "skills"` Always `skills`: the Skills API. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `class OrganizationRateLimitWebSearchGroup` - `JsonElement Type = "web_search"` Always `web_search`: the Messages API web search tool. - `required string ID` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `required IReadOnlyList Limits` The workspace's limiter values for this group. By default only the limiter types with a workspace-level override are listed. With `include_inherited` set to `true`, the limiter types the workspace inherits from the organization are listed too, each marked by `source`. - `required string Type` The limiter type (for example, `requests_per_minute` or `input_tokens_per_minute`). - `required long? OrgLimit` The organization-level value for the same limiter type, for reference. `null` when the organization has no limit configured for this limiter type. - `required Source Source` Where `value` comes from. `organization` values are listed only when `include_inherited` is `true`, and then `value` equals `org_limit`. - `class WorkspaceRateLimitWorkspaceSource` - `JsonElement Type = "workspace"` Always `workspace`: a workspace-level override is stored. - `class WorkspaceRateLimitOrganizationSource` - `JsonElement Type = "organization"` Always `organization`: no workspace-level override is stored, so the organization's value applies. - `required long Value` The workspace's value for this limiter type: the workspace-level override when `source.type` is `workspace`, otherwise the organization's value. - `required IReadOnlyList? Models` Model names this entry's limits apply to, including aliases. `null` when `group.type` is not `"model_group"`. The list covers the models this workspace has access to, so it can differ between workspaces. - `required string RateLimitID` The `id` of the organization's RateLimit entry this entry applies to. - `required string WorkspaceID` ID of the Workspace this entry applies to. #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.RateLimits; RateLimitUpdateParams parameters = new() { WorkspaceID = "workspace_id", RateLimitID = "rate_limit_id", Limits = [ new() { Type = WorkspaceRateLimitType.FastItpmca, Value = 0, }, ], }; var workspaceRateLimit = await client.Organization.Workspaces.RateLimits.Update(parameters); Console.WriteLine(workspaceRateLimit); ``` ##### Response (200) ```json { "group": { "id": "id", "display_name": "display_name", "type": "model_group" }, "limits": [ { "org_limit": 0, "source": { "type": "workspace" }, "type": "type", "value": 0 } ], "models": [ "string" ], "rate_limit_id": "rate_limit_id", "type": "workspace_rate_limit", "workspace_id": "workspace_id" } ``` ## Workspaces › Members ### List Workspace Members `MemberListPage Organization.Workspaces.Members.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/workspaces/{workspace_id}/members` List Workspace Members #### Parameters - `MemberListParams parameters` - `required string workspaceID` (path parameter) ID of the Workspace. - `string afterID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `string beforeID` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `long limit` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 #### Returns - `class WorkspaceMember` - `JsonElement Type = "workspace_member"` Object type. For Workspace Members, this is always `"workspace_member"`. - `required string UserID` ID of the User. - `required string WorkspaceID` ID of the Workspace. - `required WorkspaceRole WorkspaceRole` Role of the Workspace Member. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.Members; MemberListParams parameters = new() { WorkspaceID = "workspace_id" }; var page = await client.Organization.Workspaces.Members.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "type": "workspace_member", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ### Create Workspace Member `WorkspaceMember Organization.Workspaces.Members.Add(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces/{workspace_id}/members` Create Workspace Member #### Parameters - `MemberAddParams parameters` - `required string workspaceID` (path parameter) ID of the Workspace. - `required string userID` ID of the User. - `required NoBillingWorkspaceRole workspaceRole` Role of the new Workspace Member. Cannot be `workspace_billing`. #### Returns - `class WorkspaceMember` - `JsonElement Type = "workspace_member"` Object type. For Workspace Members, this is always `"workspace_member"`. - `required string UserID` ID of the User. - `required string WorkspaceID` ID of the Workspace. - `required WorkspaceRole WorkspaceRole` Role of the Workspace Member. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; using Anthropic.Models.Organization.Workspaces.Members; MemberAddParams parameters = new() { WorkspaceID = "workspace_id", UserID = "user_01WCz1FkmYMm4gnmykNKUu3Q", WorkspaceRole = NoBillingWorkspaceRole.WorkspaceAdmin, }; var workspaceMember = await client.Organization.Workspaces.Members.Add(parameters); Console.WriteLine(workspaceMember); ``` ##### Response (200) ```json { "type": "workspace_member", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ``` ### Get Workspace Member `WorkspaceMember Organization.Workspaces.Members.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}` Get Workspace Member #### Parameters - `MemberRetrieveParams parameters` - `required string workspaceID` (path parameter) ID of the Workspace. - `required string userID` (path parameter) ID of the User. #### Returns - `class WorkspaceMember` - `JsonElement Type = "workspace_member"` Object type. For Workspace Members, this is always `"workspace_member"`. - `required string UserID` ID of the User. - `required string WorkspaceID` ID of the Workspace. - `required WorkspaceRole WorkspaceRole` Role of the Workspace Member. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.Members; MemberRetrieveParams parameters = new() { WorkspaceID = "workspace_id", UserID = "user_id", }; var workspaceMember = await client.Organization.Workspaces.Members.Retrieve(parameters); Console.WriteLine(workspaceMember); ``` ##### Response (200) ```json { "type": "workspace_member", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ``` ### Update Workspace Member `WorkspaceMember Organization.Workspaces.Members.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}` Update Workspace Member #### Parameters - `MemberUpdateParams parameters` - `required string workspaceID` (path parameter) ID of the Workspace. - `required string userID` (path parameter) ID of the User. - `required WorkspaceRole workspaceRole` New workspace role for the User. #### Returns - `class WorkspaceMember` - `JsonElement Type = "workspace_member"` Object type. For Workspace Members, this is always `"workspace_member"`. - `required string UserID` ID of the User. - `required string WorkspaceID` ID of the Workspace. - `required WorkspaceRole WorkspaceRole` Role of the Workspace Member. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; using Anthropic.Models.Organization.Workspaces.Members; MemberUpdateParams parameters = new() { WorkspaceID = "workspace_id", UserID = "user_id", WorkspaceRole = WorkspaceRole.WorkspaceAdmin, }; var workspaceMember = await client.Organization.Workspaces.Members.Update(parameters); Console.WriteLine(workspaceMember); ``` ##### Response (200) ```json { "type": "workspace_member", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ``` ### Delete Workspace Member `MemberRemoveResponse Organization.Workspaces.Members.Remove(parameters, cancellationToken = default)` **DELETE** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}` Delete Workspace Member #### Parameters - `MemberRemoveParams parameters` - `required string workspaceID` (path parameter) ID of the Workspace. - `required string userID` (path parameter) ID of the User. #### Returns - `class MemberRemoveResponse` - `JsonElement Type = "workspace_member_deleted"` Deleted object type. For Workspace Members, this is always `"workspace_member_deleted"`. - `required string UserID` ID of the User. - `required string WorkspaceID` ID of the Workspace. #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.Members; MemberRemoveParams parameters = new() { WorkspaceID = "workspace_id", UserID = "user_id", }; var member = await client.Organization.Workspaces.Members.Remove(parameters); Console.WriteLine(member); ``` ##### Response (200) ```json { "type": "workspace_member_deleted", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" } ``` ## Workspaces › Service Accounts ### List Service Account Workspace Members `ServiceAccountListPage Organization.Workspaces.ServiceAccounts.List(parameters, cancellationToken = default)` **GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). List the service accounts that are members of a workspace. Each entry includes the service account's `workspace_role`. Use `limit` and the `next_page` cursor to paginate. Archived workspaces return 400; use `GET /service_accounts/{id}/workspaces` to audit memberships of an archived workspace. The implicit default-workspace membership is not included in this list. Memberships of archived service accounts are omitted from the results. #### Parameters - `ServiceAccountListParams parameters` - `required string workspaceID` (path parameter) ID of the workspace. - `long limit` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `string? page` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class ServiceAccountWorkspaceMember` - `JsonElement Type = "service_account_workspace_member"` - `required string? CreatedByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `required bool? Implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `required string ServiceAccountID` Tagged service account ID (`svac_...`). - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`). - `required WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.ServiceAccounts; ServiceAccountListParams parameters = new() { WorkspaceID = "workspace_id" }; var page = await client.Organization.Workspaces.ServiceAccounts.List(parameters); await foreach (var item in page.Paginate()) { Console.WriteLine(item); } ``` ##### Response (200) ```json { "data": [ { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ], "next_page": "next_page" } ``` ### Create Service Account Workspace Member `ServiceAccountWorkspaceMember Organization.Workspaces.ServiceAccounts.Add(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Add a service account to a workspace with the given `workspace_role`. The role determines what the service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user` member of the default workspace; adding it explicitly assigns a chosen role. If the service account is already an explicit member of the workspace, its `workspace_role` is replaced with the value supplied here. Archived workspaces return 400. Archived service accounts cannot be added and are rejected. #### Parameters - `ServiceAccountAddParams parameters` - `required string workspaceID` (path parameter) ID of the workspace. - `required string serviceAccountID` Tagged service account ID to add. - `required NoBillingWorkspaceRole workspaceRole` Role to assign to the service account in this workspace. #### Returns - `class ServiceAccountWorkspaceMember` - `JsonElement Type = "service_account_workspace_member"` - `required string? CreatedByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `required bool? Implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `required string ServiceAccountID` Tagged service account ID (`svac_...`). - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`). - `required WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; using Anthropic.Models.Organization.Workspaces.ServiceAccounts; ServiceAccountAddParams parameters = new() { WorkspaceID = "workspace_id", ServiceAccountID = "service_account_id", WorkspaceRole = NoBillingWorkspaceRole.WorkspaceAdmin, }; var serviceAccountWorkspaceMember = await client.Organization.Workspaces.ServiceAccounts.Add(parameters); Console.WriteLine(serviceAccountWorkspaceMember); ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### Get Service Account Workspace Member `ServiceAccountWorkspaceMember Organization.Workspaces.ServiceAccounts.Retrieve(parameters, cancellationToken = default)` **GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Retrieve a service account's membership in a workspace. Returns the membership record, including the service account's `workspace_role` in this workspace. Archived workspaces return 400. For the default workspace, returns the implicit (`implicit: true`) membership when no explicit membership exists; an explicitly added membership is returned with its assigned role. An archived service account returns 404. #### Parameters - `ServiceAccountRetrieveParams parameters` - `required string workspaceID` (path parameter) ID of the workspace. - `required string serviceAccountID` (path parameter) ID of the service account. #### Returns - `class ServiceAccountWorkspaceMember` - `JsonElement Type = "service_account_workspace_member"` - `required string? CreatedByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `required bool? Implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `required string ServiceAccountID` Tagged service account ID (`svac_...`). - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`). - `required WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.ServiceAccounts; ServiceAccountRetrieveParams parameters = new() { WorkspaceID = "workspace_id", ServiceAccountID = "service_account_id", }; var serviceAccountWorkspaceMember = await client.Organization.Workspaces.ServiceAccounts.Retrieve(parameters); Console.WriteLine(serviceAccountWorkspaceMember); ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### Update Service Account Workspace Member `ServiceAccountWorkspaceMember Organization.Workspaces.ServiceAccounts.Update(parameters, cancellationToken = default)` **POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Change a service account's role in a workspace. The new `workspace_role` replaces the current one. Only explicit memberships can be updated; to set a role on the implicit default-workspace membership, add the service account explicitly with `POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces return 400. Archived service accounts cannot be updated and are rejected. #### Parameters - `ServiceAccountUpdateParams parameters` - `required string workspaceID` (path parameter) ID of the workspace. - `required string serviceAccountID` (path parameter) ID of the service account. - `required NoBillingWorkspaceRole workspaceRole` New role for the service account in this workspace. #### Returns - `class ServiceAccountWorkspaceMember` - `JsonElement Type = "service_account_workspace_member"` - `required string? CreatedByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `required bool? Implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `required string ServiceAccountID` Tagged service account ID (`svac_...`). - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`). - `required WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `WorkspaceAdmin("workspace_admin")` - `WorkspaceBilling("workspace_billing")` - `WorkspaceDeveloper("workspace_developer")` - `WorkspaceRestrictedDeveloper("workspace_restricted_developer")` - `WorkspaceUser("workspace_user")` #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces; using Anthropic.Models.Organization.Workspaces.ServiceAccounts; ServiceAccountUpdateParams parameters = new() { WorkspaceID = "workspace_id", ServiceAccountID = "service_account_id", WorkspaceRole = NoBillingWorkspaceRole.WorkspaceAdmin, }; var serviceAccountWorkspaceMember = await client.Organization.Workspaces.ServiceAccounts.Update(parameters); Console.WriteLine(serviceAccountWorkspaceMember); ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### Delete Service Account Workspace Member `ServiceAccountRemoveResponse Organization.Workspaces.ServiceAccounts.Remove(parameters, cancellationToken = default)` **DELETE** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=csharp). Remove a service account from a workspace. Removal is idempotent (returns 200 even if the membership was already removed). A DELETE against the implicit default-workspace membership returns 200 but is a no-op and the membership persists; deleting an explicit default-workspace row reverts to the implicit `workspace_user` membership. Archived workspaces return 400. #### Parameters - `ServiceAccountRemoveParams parameters` - `required string workspaceID` (path parameter) ID of the workspace. - `required string serviceAccountID` (path parameter) ID of the service account. #### Returns - `class ServiceAccountRemoveResponse` - `JsonElement Type = "service_account_workspace_member_deleted"` - `required string ServiceAccountID` Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op. - `required string WorkspaceID` Tagged workspace ID (`wrkspc_...`) named in the delete request. #### Example ```csharp using System; using Anthropic.Models.Organization.Workspaces.ServiceAccounts; ServiceAccountRemoveParams parameters = new() { WorkspaceID = "workspace_id", ServiceAccountID = "service_account_id", }; var serviceAccount = await client.Organization.Workspaces.ServiceAccounts.Remove(parameters); Console.WriteLine(serviceAccount); ``` ##### Response (200) ```json { "service_account_id": "service_account_id", "type": "service_account_workspace_member_deleted", "workspace_id": "workspace_id" } ```