Claude Platform Docs

Organization

Get Current Organization
GET/v1/organizations/me

Retrieve information about the organization associated with the authenticated API key.

Models
BetaOrganization object{ type, id, name }
type: "organization"

Object type.

For Organizations, this is always "organization".

defaultorganization
id: string

ID of the Organization.

formatuuid
name: string

Name of the Organization.

BetaOrganizationRole = "admin" or "billing" or "claude_code_user" or 6 more
One of the following:
"admin"
"billing"
"claude_code_user"
"developer"
"managed"
"membership_admin"
"owner"
"primary_owner"
"user"

OrganizationAPI Keys

List API Keys
GET/v1/organizations/api_keys
Retrieve API Key (Admin API)
GET/v1/organizations/api_keys/{api_key_id}

Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to API keys in the Claude Console.

Update API Key
POST/v1/organizations/api_keys/{api_key_id}

OrganizationExternal Keys

Create External Key
POST/v1/organizations/external_keys

Create an external key config owned by the caller's organization.

List External Keys
GET/v1/organizations/external_keys

List external key configs in the caller's organization.

Get External Key
GET/v1/organizations/external_keys/{external_key_id}

Retrieve a single external key config in the caller's organization by ID.

Update External Key
POST/v1/organizations/external_keys/{external_key_id}

Partially update an external key config. Omitted fields are left unchanged.

Delete External Key
DELETE/v1/organizations/external_keys/{external_key_id}

Delete an external key config.

Validate External Key
POST/v1/organizations/external_keys/{external_key_id}/validate

Validate an external key config against the customer's KMS.

OrganizationFederationIssuers

Create Federation Issuer
POST/v1/organizations/federation_issuers

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

List Federation Issuers
GET/v1/organizations/federation_issuers

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Get Federation Issuer
GET/v1/organizations/federation_issuers/{federation_issuer_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Update Federation Issuer
POST/v1/organizations/federation_issuers/{federation_issuer_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Archive Federation Issuer
POST/v1/organizations/federation_issuers/{federation_issuer_id}/archive

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

OrganizationFederationRules

Create Federation Rule
POST/v1/organizations/federation_rules

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

List Federation Rules
GET/v1/organizations/federation_rules

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Get Federation Rule
GET/v1/organizations/federation_rules/{federation_rule_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Update Federation Rule
POST/v1/organizations/federation_rules/{federation_rule_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Archive Federation Rule
POST/v1/organizations/federation_rules/{federation_rule_id}/archive

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

OrganizationFederationRulesWorkspaces

Add Federation Rule Workspace
POST/v1/organizations/federation_rules/{federation_rule_id}/workspaces

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

List Federation Rule Workspaces
GET/v1/organizations/federation_rules/{federation_rule_id}/workspaces

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Remove Federation Rule Workspace
DELETE/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

OrganizationInvites

Create Invite
POST/v1/organizations/invites

Invite a user to join the organization by email.

List Invites
GET/v1/organizations/invites

List the organization's invites.

Get Invite
GET/v1/organizations/invites/{invite_id}

Retrieve an invite by ID.

Delete Invite
DELETE/v1/organizations/invites/{invite_id}

Delete a pending invite.

OrganizationService Accounts

Create Service Account
POST/v1/organizations/service_accounts

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

List Service Accounts
GET/v1/organizations/service_accounts

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Get Service Account
GET/v1/organizations/service_accounts/{service_account_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Update Service Account
POST/v1/organizations/service_accounts/{service_account_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Archive Service Account
POST/v1/organizations/service_accounts/{service_account_id}/archive

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

OrganizationService AccountsWorkspaces

Add Workspace To Service Account
POST/v1/organizations/service_accounts/{service_account_id}/workspaces

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

List Workspaces For Service Account
GET/v1/organizations/service_accounts/{service_account_id}/workspaces

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Remove Workspace From Service Account
DELETE/v1/organizations/service_accounts/{service_account_id}/workspaces/{workspace_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

OrganizationUsers

List Users
GET/v1/organizations/users

List the organization's members.

Get User
GET/v1/organizations/users/{user_id}

Retrieve a member of the organization by user ID.

Update User
POST/v1/organizations/users/{user_id}

Update a member's organization role.

Remove User
DELETE/v1/organizations/users/{user_id}

Remove a member from the organization.

OrganizationWorkspaces

List Workspaces
GET/v1/organizations/workspaces
Create Workspace
POST/v1/organizations/workspaces
Get Workspace
GET/v1/organizations/workspaces/{workspace_id}
Update Workspace
POST/v1/organizations/workspaces/{workspace_id}
Archive Workspace
POST/v1/organizations/workspaces/{workspace_id}/archive

OrganizationWorkspacesRate Limits

List Workspace Rate Limits
GET/v1/organizations/workspaces/{workspace_id}/rate_limits

List rate-limit overrides configured for a workspace.

OrganizationWorkspacesMembers

List Workspace Members
GET/v1/organizations/workspaces/{workspace_id}/members
Create Workspace Member
POST/v1/organizations/workspaces/{workspace_id}/members
Get Workspace Member
GET/v1/organizations/workspaces/{workspace_id}/members/{user_id}
Update Workspace Member
POST/v1/organizations/workspaces/{workspace_id}/members/{user_id}
Delete Workspace Member
DELETE/v1/organizations/workspaces/{workspace_id}/members/{user_id}

OrganizationWorkspacesService Accounts

List Service Account Workspace Members
GET/v1/organizations/workspaces/{workspace_id}/service_accounts

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Create Service Account Workspace Member
POST/v1/organizations/workspaces/{workspace_id}/service_accounts

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Get Service Account Workspace Member
GET/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Update Service Account Workspace Member
POST/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Delete Service Account Workspace Member
DELETE/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

OrganizationRate Limits

List Organization Rate Limits
GET/v1/organizations/rate_limits

List Messages API rate limits for your organization.

OrganizationCompliance Settings

Get Compliance Settings
GET/v1/organizations/compliance_settings

Retrieve your organization's Compliance Settings.

Update Compliance Settings
POST/v1/organizations/compliance_settings

Update your organization's Compliance Settings.

OrganizationUsage Report

Get Messages Usage Report
GET/v1/organizations/usage_report/messages
Get Claude Code Usage Report
GET/v1/organizations/usage_report/claude_code

Retrieve daily aggregated usage metrics for Claude Code users. Enables organizations to analyze developer productivity and build custom dashboards.

OrganizationCost Report

Get Cost Report
GET/v1/organizations/cost_report

OrganizationMCP Tunnels

List Tunnels
Deprecated
GET/v1/organizations/tunnels

Deprecated. This Admin API endpoint is superseded by /v1/tunnels on the Claude API and will be removed after a migration window. New integrations should use /v1/tunnels with the anthropic-beta: mcp-tunnels-2026-06-22 header and a WIF token carrying the workspace:manage_tunnels scope. Existing integrations continue to work with the mcp-tunnels-2026-05-19 header and org:manage_tunnels scope during the migration window.

Get Tunnel
Deprecated
GET/v1/organizations/tunnels/{tunnel_id}

Deprecated. This Admin API endpoint is superseded by /v1/tunnels on the Claude API and will be removed after a migration window. New integrations should use /v1/tunnels with the anthropic-beta: mcp-tunnels-2026-06-22 header and a WIF token carrying the workspace:manage_tunnels scope. Existing integrations continue to work with the mcp-tunnels-2026-05-19 header and org:manage_tunnels scope during the migration window.

Archive Tunnel
Deprecated
POST/v1/organizations/tunnels/{tunnel_id}/archive

Deprecated. This Admin API endpoint is superseded by /v1/tunnels on the Claude API and will be removed after a migration window. New integrations should use /v1/tunnels with the anthropic-beta: mcp-tunnels-2026-06-22 header and a WIF token carrying the workspace:manage_tunnels scope. Existing integrations continue to work with the mcp-tunnels-2026-05-19 header and org:manage_tunnels scope during the migration window.

Reveal Tunnel Token
Deprecated
POST/v1/organizations/tunnels/{tunnel_id}/reveal_token

Deprecated. This Admin API endpoint is superseded by /v1/tunnels on the Claude API and will be removed after a migration window. New integrations should use /v1/tunnels with the anthropic-beta: mcp-tunnels-2026-06-22 header and a WIF token carrying the workspace:manage_tunnels scope. Existing integrations continue to work with the mcp-tunnels-2026-05-19 header and org:manage_tunnels scope during the migration window.

Rotate Tunnel Token
Deprecated
POST/v1/organizations/tunnels/{tunnel_id}/rotate_token

Deprecated. This Admin API endpoint is superseded by /v1/tunnels on the Claude API and will be removed after a migration window. New integrations should use /v1/tunnels with the anthropic-beta: mcp-tunnels-2026-06-22 header and a WIF token carrying the workspace:manage_tunnels scope. Existing integrations continue to work with the mcp-tunnels-2026-05-19 header and org:manage_tunnels scope during the migration window.

OrganizationMCP TunnelsTunnel Certificates

Create Tunnel Certificate
Deprecated
POST/v1/organizations/tunnels/{tunnel_id}/certificates

Deprecated. This Admin API endpoint is superseded by /v1/tunnels on the Claude API and will be removed after a migration window. New integrations should use /v1/tunnels with the anthropic-beta: mcp-tunnels-2026-06-22 header and a WIF token carrying the workspace:manage_tunnels scope. Existing integrations continue to work with the mcp-tunnels-2026-05-19 header and org:manage_tunnels scope during the migration window.

List Tunnel Certificates
Deprecated
GET/v1/organizations/tunnels/{tunnel_id}/certificates

Deprecated. This Admin API endpoint is superseded by /v1/tunnels on the Claude API and will be removed after a migration window. New integrations should use /v1/tunnels with the anthropic-beta: mcp-tunnels-2026-06-22 header and a WIF token carrying the workspace:manage_tunnels scope. Existing integrations continue to work with the mcp-tunnels-2026-05-19 header and org:manage_tunnels scope during the migration window.

Get Tunnel Certificate
Deprecated
GET/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}

Deprecated. This Admin API endpoint is superseded by /v1/tunnels on the Claude API and will be removed after a migration window. New integrations should use /v1/tunnels with the anthropic-beta: mcp-tunnels-2026-06-22 header and a WIF token carrying the workspace:manage_tunnels scope. Existing integrations continue to work with the mcp-tunnels-2026-05-19 header and org:manage_tunnels scope during the migration window.

Archive Tunnel Certificate
Deprecated
POST/v1/organizations/tunnels/{tunnel_id}/certificates/{certificate_id}/archive

Deprecated. This Admin API endpoint is superseded by /v1/tunnels on the Claude API and will be removed after a migration window. New integrations should use /v1/tunnels with the anthropic-beta: mcp-tunnels-2026-06-22 header and a WIF token carrying the workspace:manage_tunnels scope. Existing integrations continue to work with the mcp-tunnels-2026-05-19 header and org:manage_tunnels scope during the migration window.

OrganizationAnalytics

Get Activity Summaries
GET/v1/organizations/analytics/summaries

Get organization-wide activity summaries for a date range.

OrganizationAnalyticsUsage

Get Token Usage Over Time
GET/v1/organizations/analytics/usage_report

Get token usage over time across a date range.

Get Per-User Token Usage
GET/v1/organizations/analytics/user_usage_report

Get per-user token usage across a date range.

OrganizationAnalyticsCost

Get Cost Over Time
GET/v1/organizations/analytics/cost_report

Get cost in USD over time across a date range.

Get Per-User Cost
GET/v1/organizations/analytics/user_cost_report

Get per-user cost in USD across a date range.

OrganizationAnalyticsUsers

List User Activity
GET/v1/organizations/analytics/users

Get per-user activity for a given day, with cursor-based pagination.

OrganizationAnalyticsSkills

Get Skill Usage
GET/v1/organizations/analytics/skills

Get per-skill usage for a given day, with cursor-based pagination.

OrganizationAnalyticsConnectors

Get Connector Usage
GET/v1/organizations/analytics/connectors

Get per-connector usage for a given day, with cursor-based pagination.

OrganizationAnalyticsChat Projects

Get Chat Project Usage
GET/v1/organizations/analytics/apps/chat/projects

Get per-project activity for a given day, with cursor-based pagination.

OrganizationAnalyticsPlugins

Get Plugin Usage
GET/v1/organizations/analytics/plugins

Get per-plugin install + invocation usage for a given day, with pagination.

OrganizationAnalyticsArtifacts

Get Artifact Activity
GET/v1/organizations/analytics/artifacts

Get artifact-creation activity for a given day, broken out by MIME type.

OrganizationSpend Limits

Set Spend Limit
POST/v1/organizations/spend_limits

Set a per-user spend limit override.

Get Spend Limit
GET/v1/organizations/spend_limits/{spend_limit_id}

Retrieve a spend limit by ID.

Delete Spend Limit
DELETE/v1/organizations/spend_limits/{spend_limit_id}

Delete a per-user spend limit override.

List Effective Spend Limits
GET/v1/organizations/spend_limits/effective

List each member's effective spend limit and period-to-date spend.

OrganizationSpend LimitsIncrease Requests

List Spend Limit Increase Requests
GET/v1/organizations/spend_limit_increase_requests

List spend limit increase requests, most recent first.

Get Spend Limit Increase Request
GET/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}

Retrieve a spend limit increase request.

Approve Spend Limit Increase Request
POST/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}/approve

Approve a pending spend limit increase request.

Deny Spend Limit Increase Request
POST/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}/deny

Deny a pending spend limit increase request.

OrganizationRBAC Groups

List RBAC Groups
GET/v1/organizations/rbac_groups

List RBAC Groups in the Claude Enterprise tenant.

Get RBAC Group
GET/v1/organizations/rbac_groups/{group_id}

Retrieve an RBAC Group by ID.

Create RBAC Group
POST/v1/organizations/rbac_groups

Create an RBAC Group in the Claude Enterprise tenant. Groups created via the API have source type "direct".

Update RBAC Group
POST/v1/organizations/rbac_groups/{group_id}

Update an RBAC Group's name. Groups provisioned by an identity provider (source type "scim") cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

Delete RBAC Group
DELETE/v1/organizations/rbac_groups/{group_id}

Delete an RBAC Group. Groups provisioned by an identity provider (source type "scim") cannot be deleted via the API while an organization in the tenant uses SCIM provisioning.

OrganizationRBAC GroupsMembers

List RBAC Group Members
GET/v1/organizations/rbac_groups/{group_id}/members

List members of an RBAC Group.

Add RBAC Group Member
POST/v1/organizations/rbac_groups/{group_id}/members

Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type "scim") cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

Remove RBAC Group Member
DELETE/v1/organizations/rbac_groups/{group_id}/members/{user_id}

Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type "scim") cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

OrganizationRBAC Roles

List RBAC Roles
GET/v1/organizations/rbac_roles

List RBAC Roles in the organization.

Get RBAC Role
GET/v1/organizations/rbac_roles/{role_id}

Retrieve an RBAC Role by ID.

OrganizationRBAC RolesPermissions

List RBAC Role Permissions
GET/v1/organizations/rbac_roles/{role_id}/permissions

List the permissions an RBAC Role grants.