--- title: Organization url: https://platform.claude.com/docs/en/api/php/beta/organization --- # Organization ## Get Current Organization `$client->beta->organization->retrieve(): BetaOrganization` **GET** `/v1/organizations/me` Retrieve information about the organization associated with the authenticated API key. ### Returns - `class BetaOrganization` - `"organization" type` Object type. For Organizations, this is always `"organization"`. - `string id` ID of the Organization. - `string name` Name of the Organization. ### Example ```php beta->organization->retrieve(); var_dump($betaOrganization); ``` #### Response (200) ```json { "id": "12345678-1234-5678-1234-567812345678", "name": "Organization Name", "type": "organization" } ``` ## Domain types ### Beta Organization - `class BetaOrganization` - `"organization" type` Object type. For Organizations, this is always `"organization"`. - `string id` ID of the Organization. - `string name` Name of the Organization. ### Beta Organization Role - `enum BetaOrganizationRole` - `"admin"` - `"billing"` - `"claude_code_user"` - `"developer"` - `"managed"` - `"membership_admin"` - `"owner"` - `"primary_owner"` - `"user"` ## Organization › API Keys ### List API Keys `$client->beta->organization->apiKeys->list(?string afterID, ?string beforeID, ?string createdByUserID, ?int limit, ?Status status, ?string workspaceID): Page` **GET** `/v1/organizations/api_keys` List API Keys #### Parameters - `afterID?:optional string` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `beforeID?:optional string` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `createdByUserID?:optional string` (query parameter) Filter by the ID of the User who created the object. - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. default: 20 - `status?:optional Status` (query parameter) Filter by API key status. - `workspaceID?:optional string` (query parameter) Filter by Workspace ID. #### Returns - `class APIKey` - `"api_key" type` Object type. For API Keys, this is always `"api_key"`. - `string id` ID of the API key. - `\Datetime createdAt` RFC 3339 datetime string indicating when the API Key was created. - `?APIKeyCreatedBy createdBy` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `?\Datetime expiresAt` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. - `string name` Name of the API key. - `?string partialKeyHint` Partially redacted hint for the API key. - `?Principal principal` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `Scope scope` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `Status status` Status of the API key. #### Example ```php beta->organization->apiKeys->list( afterID: 'after_id', beforeID: 'before_id', createdByUserID: 'created_by_user_id', limit: 1, status: 'active', workspaceID: 'workspace_id', ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ### Retrieve API Key (Admin API) `$client->beta->organization->apiKeys->retrieve(string apiKeyID): APIKey` **GET** `/v1/organizations/api_keys/{api_key_id}` Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to [API keys](https://platform.claude.com/settings/keys) in the Claude Console. #### Parameters - `apiKeyID: string` (path parameter) ID of the API key. #### Returns - `class APIKey` - `"api_key" type` Object type. For API Keys, this is always `"api_key"`. - `string id` ID of the API key. - `\Datetime createdAt` RFC 3339 datetime string indicating when the API Key was created. - `?APIKeyCreatedBy createdBy` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `?\Datetime expiresAt` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. - `string name` Name of the API key. - `?string partialKeyHint` Partially redacted hint for the API key. - `?Principal principal` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `Scope scope` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `Status status` Status of the API key. #### Example ```php beta->organization->apiKeys->retrieve('api_key_id'); var_dump($betaAPIKey); ``` ##### Response (200) ```json { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key" } ``` ### Update API Key `$client->beta->organization->apiKeys->update(string apiKeyID, ?string name, ?Status status): APIKey` **POST** `/v1/organizations/api_keys/{api_key_id}` Update API Key #### Parameters - `apiKeyID: string` (path parameter) ID of the API key. - `name?:optional string` Name of the API key. - `status?:optional Status` Status of the API key. #### Returns - `class APIKey` - `"api_key" type` Object type. For API Keys, this is always `"api_key"`. - `string id` ID of the API key. - `\Datetime createdAt` RFC 3339 datetime string indicating when the API Key was created. - `?APIKeyCreatedBy createdBy` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `?\Datetime expiresAt` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. - `string name` Name of the API key. - `?string partialKeyHint` Partially redacted hint for the API key. - `?Principal principal` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `Scope scope` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `Status status` Status of the API key. #### Example ```php beta->organization->apiKeys->update( 'api_key_id', name: 'x', status: 'active' ); var_dump($betaAPIKey); ``` ##### Response (200) ```json { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key" } ``` ## Organization › External Keys ### Create External Key `$client->beta->organization->externalKeys->create(ProviderConfig providerConfig, ?string displayName, ?Geo geo): ExternalKey` **POST** `/v1/organizations/external_keys` Create an external key config owned by the caller's organization. #### Parameters - `providerConfig: ProviderConfig` KMS provider identity and auth coordinates. - `displayName?:optional string` Human-friendly display name. - `geo?:optional Geo` Data residency geo. Only `us` is supported. #### Returns - `class ExternalKey` - `"external_key" type` - `string id` Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN. - `Attachment attachment` Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted. - `\Datetime createdAt` - `?string displayName` Human-friendly display name. Null if none was set. - `string geo` Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips. - `ProviderConfig providerConfig` KMS provider identity and auth coordinates. - `\Datetime updatedAt` #### Example ```php beta->organization->externalKeys->create( providerConfig: [ 'kmsARN' => 'arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222', 'type' => 'aws', 'region' => 'us-east-1', 'roleARN' => 'arn:aws:iam::111122223333:role/anthropic-cmek', ], displayName: 'x', geo: 'us', ); var_dump($betaExternalKey); ``` ##### Response (200) ```json { "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "attachment": { "type": "attached" }, "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "prod-us-key", "geo": "us", "provider_config": { "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222", "type": "aws", "region": "us-east-1", "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek" }, "type": "external_key", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ### List External Keys `$client->beta->organization->externalKeys->list(?int limit, ?string page): PageCursor` **GET** `/v1/organizations/external_keys` List external key configs in the caller's organization. Results are ordered by creation time (newest first). Use the `next_page` cursor from the response to fetch subsequent pages. #### Parameters - `limit?:optional int` (query parameter) Number of results per page. default: 20 - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class ExternalKey` - `"external_key" type` - `string id` Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN. - `Attachment attachment` Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted. - `\Datetime createdAt` - `?string displayName` Human-friendly display name. Null if none was set. - `string geo` Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips. - `ProviderConfig providerConfig` KMS provider identity and auth coordinates. - `\Datetime updatedAt` #### Example ```php beta->organization->externalKeys->list(limit: 1, page: 'page'); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "attachment": { "type": "attached" }, "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "prod-us-key", "geo": "us", "provider_config": { "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222", "type": "aws", "region": "us-east-1", "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek" }, "type": "external_key", "updated_at": "2024-10-30T23:58:27.427722Z" } ], "next_page": "next_page" } ``` ### Get External Key `$client->beta->organization->externalKeys->retrieve(string externalKeyID): ExternalKey` **GET** `/v1/organizations/external_keys/{external_key_id}` Retrieve a single external key config in the caller's organization by ID. #### Parameters - `externalKeyID: string` (path parameter) ID of the External Key. #### Returns - `class ExternalKey` - `"external_key" type` - `string id` Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN. - `Attachment attachment` Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted. - `\Datetime createdAt` - `?string displayName` Human-friendly display name. Null if none was set. - `string geo` Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips. - `ProviderConfig providerConfig` KMS provider identity and auth coordinates. - `\Datetime updatedAt` #### Example ```php beta->organization->externalKeys->retrieve( 'external_key_id' ); var_dump($betaExternalKey); ``` ##### Response (200) ```json { "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "attachment": { "type": "attached" }, "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "prod-us-key", "geo": "us", "provider_config": { "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222", "type": "aws", "region": "us-east-1", "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek" }, "type": "external_key", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ### Update External Key `$client->beta->organization->externalKeys->update(string externalKeyID, ?string displayName, ?Geo geo, ?ProviderConfig providerConfig): ExternalKey` **POST** `/v1/organizations/external_keys/{external_key_id}` Partially update an external key config. Omitted fields are left unchanged. `display_name` is always editable. `geo` and `provider_config` cannot be changed once any workspace references this config, because previously encrypted data requires the original key identity to decrypt. #### Parameters - `externalKeyID: string` (path parameter) ID of the External Key. - `displayName?:optional string` Human-friendly display name. - `geo?:optional Geo` Data residency geo. Only `us` is supported. - `providerConfig?:optional ProviderConfig` KMS provider identity and auth coordinates. #### Returns - `class ExternalKey` - `"external_key" type` - `string id` Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN. - `Attachment attachment` Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted. - `\Datetime createdAt` - `?string displayName` Human-friendly display name. Null if none was set. - `string geo` Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips. - `ProviderConfig providerConfig` KMS provider identity and auth coordinates. - `\Datetime updatedAt` #### Example ```php beta->organization->externalKeys->update( 'external_key_id', displayName: 'x', geo: 'us', providerConfig: [ 'kmsARN' => 'arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222', 'type' => 'aws', 'region' => 'us-east-1', 'roleARN' => 'arn:aws:iam::111122223333:role/anthropic-cmek', ], ); var_dump($betaExternalKey); ``` ##### Response (200) ```json { "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "attachment": { "type": "attached" }, "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "prod-us-key", "geo": "us", "provider_config": { "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222", "type": "aws", "region": "us-east-1", "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek" }, "type": "external_key", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ### Delete External Key `$client->beta->organization->externalKeys->delete(string externalKeyID): ExternalKeyDeleteResponse` **DELETE** `/v1/organizations/external_keys/{external_key_id}` Delete an external key config. The request is rejected if any workspace still references this config. #### Parameters - `externalKeyID: string` (path parameter) ID of the External Key. #### Returns - `class ExternalKeyDeleteResponse` - `"external_key_deleted" type` - `string id` ID of the deleted External Key. #### Example ```php beta->organization->externalKeys->delete( 'external_key_id' ); var_dump($externalKey); ``` ##### Response (200) ```json { "id": "ekey_01AbCdEfGhIjKlMnOpQrStUv", "type": "external_key_deleted" } ``` ### Validate External Key `$client->beta->organization->externalKeys->validate(string externalKeyID): ExternalKeyValidateResponse` **POST** `/v1/organizations/external_keys/{external_key_id}/validate` Validate an external key config against the customer's KMS. Anthropic performs an encrypt/decrypt roundtrip against the configured KMS key and waits up to 30 seconds for the result. The response status is `success` if the roundtrip succeeded, or `failure` with an error message if it failed or timed out. #### Parameters - `externalKeyID: string` (path parameter) ID of the External Key. #### Returns - `class ExternalKeyValidateResponse` - `"external_key_validation" type` - `?string error` Error message when status is `failure`. Null otherwise. - `Status status` `success` — encrypt/decrypt roundtrip succeeded. `failure` — the roundtrip failed or timed out; see `error`. #### Example ```php beta->organization->externalKeys->validate( 'external_key_id' ); var_dump($response); ``` ##### Response (200) ```json { "error": "error", "status": "failure", "type": "external_key_validation" } ``` ## Organization › Federation › Issuers ### Create Federation Issuer `$client->beta->organization->federation->issuers->create(string issuerURL, string name, ?bool checkJTI, ?JWKS jwks, ?int maxJWTLifetimeSeconds, ?list betas): BetaFederationIssuer` **POST** `/v1/organizations/federation_issuers` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Register an OIDC issuer that Anthropic will trust for workload identity federation in your organization. The `jwks` field controls how the issuer's signing keys are obtained and takes one of three shapes selected by `type`: `discovery` (resolve keys through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS URL), or `inline` (provide a static key set). When `jwks.type` is `discovery` and no `discovery_base` is set, the issuer URL must be publicly reachable over HTTPS so Anthropic can fetch the discovery document; for `explicit_url` and `inline` modes the issuer URL is only matched as the JWT's `iss` claim and is not fetched. #### Parameters - `issuerURL: string` The `iss` claim value to match against. - `name: string` Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. - `checkJTI?:optional bool` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `jwks?:optional JWKS` How signing keys are obtained. Defaults to OIDC discovery. - `maxJWTLifetimeSeconds?:optional int` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class BetaFederationIssuer` - `"federation_issuer" type` - `string id` Tagged ID of the federation issuer. - `?\Datetime archivedAt` If set, all rules referencing this issuer reject token exchange. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `bool checkJTI` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `\Datetime createdAt` When this issuer was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `string issuerURL` The `iss` claim value. Incoming JWTs must match exactly. - `JWKS jwks` How signing keys are obtained for signature verification. - `?\Datetime jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. - `int maxJWTLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `string name` Admin-chosen slug identifier. - `?BetaFederationIssuerPollStatus pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `\Datetime updatedAt` When this issuer was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```php beta ->organization ->federation ->issuers ->create( issuerURL: 'x', name: 'x', checkJTI: true, jwks: [ 'type' => 'discovery', 'caCertPEM' => 'ca_cert_pem', 'discoveryBase' => 'discovery_base', ], maxJWTLifetimeSeconds: 1, betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaFederationIssuer); ``` ##### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### List Federation Issuers `$client->beta->organization->federation->issuers->list(?bool includeArchived, ?int limit, ?string page, ?list betas): PageCursor` **GET** `/v1/organizations/federation_issuers` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). List federation issuers in your organization. Archived issuers are excluded unless `include_archived=true`. #### Parameters - `includeArchived?:optional bool` (query parameter) Include archived resources. Defaults to false. default: false - `limit?:optional int` (query parameter) Number of results per page. default: 20 - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page`. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class BetaFederationIssuer` - `"federation_issuer" type` - `string id` Tagged ID of the federation issuer. - `?\Datetime archivedAt` If set, all rules referencing this issuer reject token exchange. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `bool checkJTI` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `\Datetime createdAt` When this issuer was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `string issuerURL` The `iss` claim value. Incoming JWTs must match exactly. - `JWKS jwks` How signing keys are obtained for signature verification. - `?\Datetime jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. - `int maxJWTLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `string name` Admin-chosen slug identifier. - `?BetaFederationIssuerPollStatus pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `\Datetime updatedAt` When this issuer was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```php beta->organization->federation->issuers->list( includeArchived: true, limit: 1, page: 'page', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ], "next_page": "next_page" } ``` ### Get Federation Issuer `$client->beta->organization->federation->issuers->retrieve(string federationIssuerID, ?list betas): BetaFederationIssuer` **GET** `/v1/organizations/federation_issuers/{federation_issuer_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Retrieve a federation issuer by its ID (`fdis_...`). #### Parameters - `federationIssuerID: string` (path parameter) ID of the federation issuer. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class BetaFederationIssuer` - `"federation_issuer" type` - `string id` Tagged ID of the federation issuer. - `?\Datetime archivedAt` If set, all rules referencing this issuer reject token exchange. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `bool checkJTI` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `\Datetime createdAt` When this issuer was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `string issuerURL` The `iss` claim value. Incoming JWTs must match exactly. - `JWKS jwks` How signing keys are obtained for signature verification. - `?\Datetime jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. - `int maxJWTLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `string name` Admin-chosen slug identifier. - `?BetaFederationIssuerPollStatus pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `\Datetime updatedAt` When this issuer was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```php beta ->organization ->federation ->issuers ->retrieve( 'federation_issuer_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24] ); var_dump($betaFederationIssuer); ``` ##### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### Update Federation Issuer `$client->beta->organization->federation->issuers->update(string federationIssuerID, ?bool checkJTI, ?string issuerURL, ?JWKS jwks, ?bool jwksPollingDisabled, ?int maxJWTLifetimeSeconds, ?string name, ?list betas): BetaFederationIssuer` **POST** `/v1/organizations/federation_issuers/{federation_issuer_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Partially update a federation issuer. Setting `jwks` replaces the full JWKS shape at once. Archived issuers cannot be updated; this returns 400. Create a new issuer instead. Updating an issuer that backs a rule with a scope outside `workspace:developer` or `workspace:inference` requires a Console session. #### Parameters - `federationIssuerID: string` (path parameter) ID of the federation issuer to update. - `checkJTI?:optional bool` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `issuerURL?:optional string` Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity. - `jwks?:optional JWKS` Replaces the entire JWKS configuration. - `jwksPollingDisabled?:optional bool` Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected. - `maxJWTLifetimeSeconds?:optional int` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `name?:optional string` Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class BetaFederationIssuer` - `"federation_issuer" type` - `string id` Tagged ID of the federation issuer. - `?\Datetime archivedAt` If set, all rules referencing this issuer reject token exchange. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `bool checkJTI` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `\Datetime createdAt` When this issuer was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `string issuerURL` The `iss` claim value. Incoming JWTs must match exactly. - `JWKS jwks` How signing keys are obtained for signature verification. - `?\Datetime jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. - `int maxJWTLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `string name` Admin-chosen slug identifier. - `?BetaFederationIssuerPollStatus pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `\Datetime updatedAt` When this issuer was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```php beta ->organization ->federation ->issuers ->update( 'federation_issuer_id', checkJTI: true, issuerURL: 'x', jwks: [ 'type' => 'discovery', 'caCertPEM' => 'ca_cert_pem', 'discoveryBase' => 'discovery_base', ], jwksPollingDisabled: true, maxJWTLifetimeSeconds: 1, name: 'x', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaFederationIssuer); ``` ##### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### Archive Federation Issuer `$client->beta->organization->federation->issuers->archive(string federationIssuerID, ?list betas): BetaFederationIssuer` **POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Archive a federation issuer. Idempotent; re-archiving returns the issuer with its original `archived_at`. Rejected with 400 if any live (non-archived) federation rule still references the issuer; archive those rules first (a rule's issuer cannot be changed), or recreate them against another issuer. #### Parameters - `federationIssuerID: string` (path parameter) ID of the federation issuer to archive. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class BetaFederationIssuer` - `"federation_issuer" type` - `string id` Tagged ID of the federation issuer. - `?\Datetime archivedAt` If set, all rules referencing this issuer reject token exchange. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this issuer. - `bool checkJTI` Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement. - `\Datetime createdAt` When this issuer was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this issuer. - `string issuerURL` The `iss` claim value. Incoming JWTs must match exactly. - `JWKS jwks` How signing keys are obtained for signature verification. - `?\Datetime jwksPollingDisabledAt` If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session. - `int maxJWTLifetimeSeconds` Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected. - `string name` Admin-chosen slug identifier. - `?BetaFederationIssuerPollStatus pollStatus` Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet. - `\Datetime updatedAt` When this issuer was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer. #### Example ```php beta ->organization ->federation ->issuers ->archive( 'federation_issuer_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24] ); var_dump($betaFederationIssuer); ``` ##### Response (200) ```json { "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "check_jti": true, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "issuer_url": "https://token.actions.githubusercontent.com", "jwks": { "type": "discovery", "ca_cert_pem": "ca_cert_pem", "discovery_base": "discovery_base" }, "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z", "max_jwt_lifetime_seconds": 0, "name": "github-actions", "poll_status": { "consecutive_failures": 0, "last_fetched_at": "2019-12-27T18:11:19.117Z", "next_poll_at": "2019-12-27T18:11:19.117Z" }, "type": "federation_issuer", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Organization › Federation › Rules ### Create Federation Rule `$client->beta->organization->federation->rules->create(string issuerID, BetaFederationRuleMatch match, string name, string oauthScope, BetaServiceAccountTarget target, ?bool appliesToAllWorkspaces, ?array attributes, ?string description, ?int tokenLifetimeSeconds, ?string workspaceID, ?list betas): BetaFederationRule` **POST** `/v1/organizations/federation_rules` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Create a federation rule owned by your organization. The referenced issuer and the target service account must already exist in the same organization; invalid references are rejected with a 400 error. The workspace reference is validated. Membership is not checked at rule creation: token exchange resolves a single enabled workspace per call and is rejected unless the target service account is a member of that workspace (it is implicitly a member of the default workspace). Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) must constrain tenant identity via an identity-bearing claim, a tenant-pinning subject prefix (such as `repo:YOUR_ORG/...`), or a CEL condition referencing one of those identity claims (e.g. `claims.repository_owner`). OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `issuerID: string` Tagged ID of the federation issuer. - `match: BetaFederationRuleMatch` Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient. - `name: string` Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. - `oauthScope: string` Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session. - `target: BetaServiceAccountTarget` Identity that tokens minted via this rule act as. Currently always a `service_account` target. - `appliesToAllWorkspaces?:optional bool` When true, enable this rule for every workspace in the org (including workspaces created later). - `attributes?:optional array` CEL expressions `{name: expr}` extracting named values from claims. Not yet supported; any non-empty value is rejected with 400. - `description?:optional string` Optional free-text description. - `tokenLifetimeSeconds?:optional int` Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `workspaceID?:optional string` Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class BetaFederationRule` - `"federation_rule" type` - `string id` Tagged ID of the federation rule. - `bool appliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `?\Datetime archivedAt` If set, this rule is archived and rejects token exchange. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `?array attributes` CEL expressions extracting named values from claims. Not yet supported; always null. - `\Datetime createdAt` When this rule was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `?string description` Optional free-text description. - `string issuerID` Tagged ID of the issuer whose tokens this rule accepts. - `?string issuerName` Issuer's display name at read time. - `BetaFederationRuleMatch match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string name` Admin-chosen slug identifier. - `string oauthScope` Space-separated OAuth scopes granted on the minted token. - `BetaServiceAccountTarget target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `int tokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `\Datetime updatedAt` When this rule was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `?string workspaceID` Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement. - `list workspaceIDs` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```php beta->organization->federation->rules->create( issuerID: 'issuer_id', match: [ 'audience' => 'audience', 'claims' => ['foo' => 'string'], 'condition' => 'condition', 'subjectPrefix' => 'subject_prefix', ], name: 'x', oauthScope: 'x', target: [ 'serviceAccountID' => 'svac_01SDCCSbTxrXDpWc1phhtcfK', 'type' => 'service_account', 'serviceAccountName' => 'service_account_name', ], appliesToAllWorkspaces: true, attributes: ['foo' => 'string'], description: 'description', tokenLifetimeSeconds: 60, workspaceID: 'workspace_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaFederationRule); ``` ##### Response (200) ```json { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ``` ### List Federation Rules `$client->beta->organization->federation->rules->list(?bool includeArchived, ?string issuerID, ?int limit, ?string page, ?list betas): PageCursor` **GET** `/v1/organizations/federation_rules` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). List federation rules in your organization. Optionally filter by issuer with `issuer_id`. Archived rules are excluded unless `include_archived=true`. #### Parameters - `includeArchived?:optional bool` (query parameter) Include archived resources. Defaults to false. default: false - `issuerID?:optional string` (query parameter) Filter to rules referencing this federation issuer. - `limit?:optional int` (query parameter) Number of results per page. default: 20 - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page`. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class BetaFederationRule` - `"federation_rule" type` - `string id` Tagged ID of the federation rule. - `bool appliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `?\Datetime archivedAt` If set, this rule is archived and rejects token exchange. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `?array attributes` CEL expressions extracting named values from claims. Not yet supported; always null. - `\Datetime createdAt` When this rule was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `?string description` Optional free-text description. - `string issuerID` Tagged ID of the issuer whose tokens this rule accepts. - `?string issuerName` Issuer's display name at read time. - `BetaFederationRuleMatch match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string name` Admin-chosen slug identifier. - `string oauthScope` Space-separated OAuth scopes granted on the minted token. - `BetaServiceAccountTarget target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `int tokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `\Datetime updatedAt` When this rule was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `?string workspaceID` Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement. - `list workspaceIDs` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```php beta->organization->federation->rules->list( includeArchived: true, issuerID: 'issuer_id', limit: 1, page: 'page', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ], "next_page": "next_page" } ``` ### Get Federation Rule `$client->beta->organization->federation->rules->retrieve(string federationRuleID, ?list betas): BetaFederationRule` **GET** `/v1/organizations/federation_rules/{federation_rule_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Retrieve a federation rule by its ID (`fdrl_...`). #### Parameters - `federationRuleID: string` (path parameter) ID of the federation rule. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class BetaFederationRule` - `"federation_rule" type` - `string id` Tagged ID of the federation rule. - `bool appliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `?\Datetime archivedAt` If set, this rule is archived and rejects token exchange. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `?array attributes` CEL expressions extracting named values from claims. Not yet supported; always null. - `\Datetime createdAt` When this rule was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `?string description` Optional free-text description. - `string issuerID` Tagged ID of the issuer whose tokens this rule accepts. - `?string issuerName` Issuer's display name at read time. - `BetaFederationRuleMatch match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string name` Admin-chosen slug identifier. - `string oauthScope` Space-separated OAuth scopes granted on the minted token. - `BetaServiceAccountTarget target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `int tokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `\Datetime updatedAt` When this rule was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `?string workspaceID` Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement. - `list workspaceIDs` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```php beta->organization->federation->rules->retrieve( 'federation_rule_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24] ); var_dump($betaFederationRule); ``` ##### Response (200) ```json { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ``` ### Update Federation Rule `$client->beta->organization->federation->rules->update(string federationRuleID, ?bool appliesToAllWorkspaces, ?array attributes, ?string description, ?BetaFederationRuleMatch match, ?string name, ?string oauthScope, ?BetaServiceAccountTarget target, ?int tokenLifetimeSeconds, ?string workspaceID, ?list betas): BetaFederationRule` **POST** `/v1/organizations/federation_rules/{federation_rule_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Partially update a federation rule. `issuer_id` is immutable. `match` and `target` are replaced as whole objects when set. Referenced service accounts and workspaces must exist in your organization; invalid references are rejected with a 400 error. Archived rules cannot be updated; this returns 400. Create a new rule instead. Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) must constrain tenant identity via an identity-bearing claim, a tenant-pinning subject prefix (such as `repo:YOUR_ORG/...`), or a CEL condition referencing one of those identity claims (e.g. `claims.repository_owner`). On these issuers the requirement is re-checked on every update; if an existing rule's stored match does not yet constrain tenant identity, any update (even a rename or description change) must also supply a conforming `match` in the same request. OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `federationRuleID: string` (path parameter) ID of the federation rule to update. - `appliesToAllWorkspaces?:optional bool` When true, enables this rule for every workspace in the org (including workspaces created later). Setting `false` is rejected with 400 if no workspace would remain enabled; a rule with only a legacy `workspace_id` binding continues to mint. - `attributes?:optional array` Replaces the CEL expressions `{name: expr}` extracting named values from claims. Send null to clear them. Not yet supported; any non-empty value is rejected with 400. - `description?:optional string` Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string). - `match?:optional BetaFederationRuleMatch` Replaces the entire match object. All populated matcher fields must pass. - `name?:optional string` Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. - `oauthScope?:optional string` Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session. - `target?:optional BetaServiceAccountTarget` Replaces the entire target object. Currently always a `service_account` target. - `tokenLifetimeSeconds?:optional int` Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `workspaceID?:optional string` Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class BetaFederationRule` - `"federation_rule" type` - `string id` Tagged ID of the federation rule. - `bool appliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `?\Datetime archivedAt` If set, this rule is archived and rejects token exchange. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `?array attributes` CEL expressions extracting named values from claims. Not yet supported; always null. - `\Datetime createdAt` When this rule was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `?string description` Optional free-text description. - `string issuerID` Tagged ID of the issuer whose tokens this rule accepts. - `?string issuerName` Issuer's display name at read time. - `BetaFederationRuleMatch match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string name` Admin-chosen slug identifier. - `string oauthScope` Space-separated OAuth scopes granted on the minted token. - `BetaServiceAccountTarget target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `int tokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `\Datetime updatedAt` When this rule was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `?string workspaceID` Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement. - `list workspaceIDs` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```php beta->organization->federation->rules->update( 'federation_rule_id', appliesToAllWorkspaces: true, attributes: ['foo' => 'string'], description: 'description', match: [ 'audience' => 'audience', 'claims' => ['foo' => 'string'], 'condition' => 'condition', 'subjectPrefix' => 'subject_prefix', ], name: 'x', oauthScope: 'x', target: [ 'serviceAccountID' => 'svac_01SDCCSbTxrXDpWc1phhtcfK', 'type' => 'service_account', 'serviceAccountName' => 'service_account_name', ], tokenLifetimeSeconds: 60, workspaceID: 'workspace_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaFederationRule); ``` ##### Response (200) ```json { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ``` ### Archive Federation Rule `$client->beta->organization->federation->rules->archive(string federationRuleID, ?list betas): BetaFederationRule` **POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Archive a federation rule. Token exchange through this rule stops immediately. Idempotent; re-archiving returns the rule with its original `archived_at`. Archiving clears the rule's workspace targeting (`workspace_id` and `workspace_ids` are emptied). Tokens already minted before archive remain valid until they expire. OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `federationRuleID: string` (path parameter) ID of the federation rule to archive. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class BetaFederationRule` - `"federation_rule" type` - `string id` Tagged ID of the federation rule. - `bool appliesToAllWorkspaces` When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time. - `?\Datetime archivedAt` If set, this rule is archived and rejects token exchange. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this rule. - `?array attributes` CEL expressions extracting named values from claims. Not yet supported; always null. - `\Datetime createdAt` When this rule was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this rule. - `?string description` Optional free-text description. - `string issuerID` Tagged ID of the issuer whose tokens this rule accepts. - `?string issuerName` Issuer's display name at read time. - `BetaFederationRuleMatch match` Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass. - `string name` Admin-chosen slug identifier. - `string oauthScope` Space-separated OAuth scopes granted on the minted token. - `BetaServiceAccountTarget target` What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account. - `int tokenLifetimeSeconds` Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds. - `\Datetime updatedAt` When this rule was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this rule. - `?string workspaceID` Legacy single-workspace binding. Prefer `workspace_ids` and the `/federation_rules/{federation_rule_id}/workspaces` sub-resource for managing workspace enablement. - `list workspaceIDs` Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty). #### Example ```php beta->organization->federation->rules->archive( 'federation_rule_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24] ); var_dump($betaFederationRule); ``` ##### Response (200) ```json { "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK", "applies_to_all_workspaces": true, "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "attributes": { "foo": "string" }, "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "issuer_id": "issuer_id", "issuer_name": "issuer_name", "match": { "audience": "audience", "claims": { "foo": "string" }, "condition": "condition", "subject_prefix": "subject_prefix" }, "name": "prod-deploy-pipeline", "oauth_scope": "oauth_scope", "target": { "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "type": "service_account", "service_account_name": "service_account_name" }, "token_lifetime_seconds": 0, "type": "federation_rule", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id", "workspace_id": "workspace_id", "workspace_ids": [ "string" ] } ``` ## Organization › Federation › Rules › Workspaces ### Add Federation Rule Workspace `$client->beta->organization->federation->rules->workspaces->add(string federationRuleID, string workspaceID, ?list betas): BetaFederationRuleWorkspace` **POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Enable a federation rule for a workspace. Idempotent; re-enabling returns the existing enablement. The rule and workspace must both belong to your organization. Membership of the rule's target service account in this workspace is not checked at enablement: token exchange into this workspace is rejected unless the target is a member (it is implicitly a member of the default workspace). Archived rules are rejected with 400. OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `federationRuleID: string` (path parameter) ID of the federation rule. - `workspaceID: string` Tagged ID of the workspace to enable this rule for. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class BetaFederationRuleWorkspace` - `"federation_rule_workspace" type` - `\Datetime createdAt` When this workspace was enabled for the rule. - `?string createdByActorID` Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known. - `string federationRuleID` Tagged ID of the federation rule. - `string workspaceID` Tagged ID of the workspace this rule is enabled for. - `?string workspaceName` Workspace display name. Populated when listing; null in the enable response. #### Example ```php beta ->organization ->federation ->rules ->workspaces ->add( 'federation_rule_id', workspaceID: 'workspace_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaFederationRuleWorkspace); ``` ##### Response (200) ```json { "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "federation_rule_id": "federation_rule_id", "type": "federation_rule_workspace", "workspace_id": "workspace_id", "workspace_name": "workspace_name" } ``` ### List Federation Rule Workspaces `$client->beta->organization->federation->rules->workspaces->list(string federationRuleID, ?int limit, ?string page, ?list betas): PageCursor` **GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). List workspaces where this federation rule is enabled. Returns all workspace enablements in a single response; the `limit` and `page` parameters are accepted but have no effect, and `next_page` is always `null`. Returns explicit per-workspace enablements only; for rules with `applies_to_all_workspaces` or a legacy single `workspace_id`, check those fields on the rule itself. #### Parameters - `federationRuleID: string` (path parameter) ID of the federation rule. - `limit?:optional int` (query parameter) Number of results per page. default: 20 - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page`. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class BetaFederationRuleWorkspace` - `"federation_rule_workspace" type` - `\Datetime createdAt` When this workspace was enabled for the rule. - `?string createdByActorID` Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known. - `string federationRuleID` Tagged ID of the federation rule. - `string workspaceID` Tagged ID of the workspace this rule is enabled for. - `?string workspaceName` Workspace display name. Populated when listing; null in the enable response. #### Example ```php beta->organization->federation->rules->workspaces->list( 'federation_rule_id', limit: 1, page: 'page', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "federation_rule_id": "federation_rule_id", "type": "federation_rule_workspace", "workspace_id": "workspace_id", "workspace_name": "workspace_name" } ], "next_page": "next_page" } ``` ### Remove Federation Rule Workspace `$client->beta->organization->federation->rules->workspaces->remove(string workspaceID, string federationRuleID, ?list betas): WorkspaceRemoveResponse` **DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Disable a federation rule for a workspace. Idempotent; succeeds even if the enablement was already removed. OAuth callers may only manage rules whose `oauth_scope` is `workspace:developer` or `workspace:inference`; other scopes require a Console session. #### Parameters - `federationRuleID: string` (path parameter) ID of the federation rule. - `workspaceID: string` (path parameter) ID of the workspace to disable for. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class WorkspaceRemoveResponse` - `"federation_rule_workspace_deleted" type` - `string federationRuleID` Tagged ID of the federation rule. - `string workspaceID` Tagged ID of the workspace named in the delete request. Removal is idempotent. #### Example ```php beta->organization->federation->rules->workspaces->remove( 'workspace_id', federationRuleID: 'federation_rule_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($workspace); ``` ##### Response (200) ```json { "federation_rule_id": "federation_rule_id", "type": "federation_rule_workspace_deleted", "workspace_id": "workspace_id" } ``` ## Organization › Invites ### Create Invite `$client->beta->organization->invites->create(string email, Role role, ?list rbacGroupIDs): OrganizationInvite` **POST** `/v1/organizations/invites` Invite a user to join the organization by email. On plans that draw members from a finite pool of purchased seats, the invite automatically consumes a seat from the lowest tier with availability; there is no seat-tier parameter. When no seat is free the request fails with a 400 error rather than purchasing a seat. #### Parameters - `email: string` Email of the User. - `role: Role` Role for the invited User. The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations accept `user` and `managed`; inviting with the `managed` role requires the `write:rbac_groups` scope in addition to `write:members`. - `rbacGroupIDs?:optional list` RBAC group IDs to assign to the User when the Invite is accepted. A non-empty array is accepted only for a Claude Enterprise organization with RBAC groups, and requires the key to carry the `write:rbac_groups` scope. #### Returns - `class OrganizationInvite` - `"invite" type` Object type. For Invites, this is always `"invite"`. - `string id` ID of the Invite. - `?\Datetime acceptedAt` RFC 3339 datetime string indicating when the Invite was accepted, or null. - `string email` Email of the User being invited. - `\Datetime expiresAt` RFC 3339 datetime string indicating when the Invite expires. - `\Datetime invitedAt` RFC 3339 datetime string indicating when the Invite was created. - `list rbacGroupIDs` RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none. - `BetaOrganizationRole role` Organization role of the User. - `Status status` Status of the Invite. #### Example ```php beta->organization->invites->create( email: 'user@emaildomain.com', role: 'user', rbacGroupIDs: ['string'] ); var_dump($betaOrganizationInvite); ``` ##### Response (200) ```json { "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu", "accepted_at": "2019-12-27T18:11:19.117Z", "email": "user@emaildomain.com", "expires_at": "2024-11-20T23:58:27.427722Z", "invited_at": "2024-10-30T23:58:27.427722Z", "rbac_group_ids": [ "string" ], "role": "admin", "status": "pending", "type": "invite" } ``` ### List Invites `$client->beta->organization->invites->list(?string afterID, ?string beforeID, ?string email, ?int limit, ?list roles, ?list statuses): Page` **GET** `/v1/organizations/invites` List the organization's invites. #### Parameters - `afterID?:optional string` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `beforeID?:optional string` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `email?:optional string` (query parameter) Filter by the email address the Invite was sent to. Matches the same way as the Users list's `email` filter (normalized, case-insensitive). - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. default: 20 - `roles?:optional list` (query parameter) Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together. Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`. - `statuses?:optional list` (query parameter) Filter by Invite status. Repeatable; values are OR'ed together. Omit to return `pending`, `accepted`, and `expired` Invites alike. #### Returns - `class OrganizationInvite` - `"invite" type` Object type. For Invites, this is always `"invite"`. - `string id` ID of the Invite. - `?\Datetime acceptedAt` RFC 3339 datetime string indicating when the Invite was accepted, or null. - `string email` Email of the User being invited. - `\Datetime expiresAt` RFC 3339 datetime string indicating when the Invite expires. - `\Datetime invitedAt` RFC 3339 datetime string indicating when the Invite was created. - `list rbacGroupIDs` RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none. - `BetaOrganizationRole role` Organization role of the User. - `Status status` Status of the Invite. #### Example ```php beta->organization->invites->list( afterID: 'after_id', beforeID: 'before_id', email: 'dev@stainless.com', limit: 1, roles: ['string'], statuses: ['accepted'], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu", "accepted_at": "2019-12-27T18:11:19.117Z", "email": "user@emaildomain.com", "expires_at": "2024-11-20T23:58:27.427722Z", "invited_at": "2024-10-30T23:58:27.427722Z", "rbac_group_ids": [ "string" ], "role": "admin", "status": "pending", "type": "invite" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ### Get Invite `$client->beta->organization->invites->retrieve(string inviteID): OrganizationInvite` **GET** `/v1/organizations/invites/{invite_id}` Retrieve an invite by ID. #### Parameters - `inviteID: string` (path parameter) ID of the Invite. #### Returns - `class OrganizationInvite` - `"invite" type` Object type. For Invites, this is always `"invite"`. - `string id` ID of the Invite. - `?\Datetime acceptedAt` RFC 3339 datetime string indicating when the Invite was accepted, or null. - `string email` Email of the User being invited. - `\Datetime expiresAt` RFC 3339 datetime string indicating when the Invite expires. - `\Datetime invitedAt` RFC 3339 datetime string indicating when the Invite was created. - `list rbacGroupIDs` RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none. - `BetaOrganizationRole role` Organization role of the User. - `Status status` Status of the Invite. #### Example ```php beta->organization->invites->retrieve( 'invite_id' ); var_dump($betaOrganizationInvite); ``` ##### Response (200) ```json { "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu", "accepted_at": "2019-12-27T18:11:19.117Z", "email": "user@emaildomain.com", "expires_at": "2024-11-20T23:58:27.427722Z", "invited_at": "2024-10-30T23:58:27.427722Z", "rbac_group_ids": [ "string" ], "role": "admin", "status": "pending", "type": "invite" } ``` ### Delete Invite `$client->beta->organization->invites->delete(string inviteID): InviteDeleteResponse` **DELETE** `/v1/organizations/invites/{invite_id}` Delete a pending invite. #### Parameters - `inviteID: string` (path parameter) ID of the Invite. #### Returns - `class InviteDeleteResponse` - `"invite_deleted" type` Deleted object type. For Invites, this is always `"invite_deleted"`. - `string id` ID of the Invite. #### Example ```php beta->organization->invites->delete('invite_id'); var_dump($invite); ``` ##### Response (200) ```json { "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu", "type": "invite_deleted" } ``` ## Organization › Service Accounts ### Create Service Account `$client->beta->organization->serviceAccounts->create(string name, ?string description, ?OrganizationRole organizationRole, ?list betas): ServiceAccount` **POST** `/v1/organizations/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Create a service account. A service account is a named workload identity that federation rules target. `organization_role` is `developer` (default) or `admin`; a rule may only be created or retargeted to grant `org:admin` scope when the target's `organization_role` is `admin`. Creating an `admin`-role service account requires an interactive credential (a user OAuth token or a Console session) — a workload may only create `developer`-role service accounts. #### Parameters - `name: string` Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. - `description?:optional string` Optional free-text description. - `organizationRole?:optional OrganizationRole` Org-level role. Defaults to `developer`. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class ServiceAccount` - `"service_account" type` - `string id` Tagged ID of the service account. - `?\Datetime archivedAt` If set, this service account is archived. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `\Datetime createdAt` When this service account was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `?string description` Optional free-text description. - `string name` Admin-chosen slug identifier. - `OrganizationRole organizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `\Datetime updatedAt` When this service account was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. #### Example ```php beta->organization->serviceAccounts->create( name: 'ci-deploy-bot', description: 'description', organizationRole: 'admin', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaServiceAccount); ``` ##### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### List Service Accounts `$client->beta->organization->serviceAccounts->list(?bool includeArchived, ?int limit, ?string page, ?list betas): PageCursor` **GET** `/v1/organizations/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). List service accounts in the caller's organization. Results are ordered by creation time, newest first. Use `limit` and the `next_page` cursor to paginate; set `include_archived=true` to include archived service accounts. #### Parameters - `includeArchived?:optional bool` (query parameter) Include archived resources. Defaults to false. default: false - `limit?:optional int` (query parameter) Number of results per page. default: 20 - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page`. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class ServiceAccount` - `"service_account" type` - `string id` Tagged ID of the service account. - `?\Datetime archivedAt` If set, this service account is archived. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `\Datetime createdAt` When this service account was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `?string description` Optional free-text description. - `string name` Admin-chosen slug identifier. - `OrganizationRole organizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `\Datetime updatedAt` When this service account was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. #### Example ```php beta->organization->serviceAccounts->list( includeArchived: true, limit: 1, page: 'page', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ], "next_page": "next_page" } ``` ### Get Service Account `$client->beta->organization->serviceAccounts->retrieve(string serviceAccountID, ?list betas): ServiceAccount` **GET** `/v1/organizations/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Retrieve a service account by its ID (`svac_...`). #### Parameters - `serviceAccountID: string` (path parameter) ID of the service account. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class ServiceAccount` - `"service_account" type` - `string id` Tagged ID of the service account. - `?\Datetime archivedAt` If set, this service account is archived. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `\Datetime createdAt` When this service account was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `?string description` Optional free-text description. - `string name` Admin-chosen slug identifier. - `OrganizationRole organizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `\Datetime updatedAt` When this service account was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. #### Example ```php beta->organization->serviceAccounts->retrieve( 'service_account_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24] ); var_dump($betaServiceAccount); ``` ##### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### Update Service Account `$client->beta->organization->serviceAccounts->update(string serviceAccountID, ?string description, ?OrganizationRole organizationRole, ?list betas): ServiceAccount` **POST** `/v1/organizations/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Update a service account. Only `description` and `organization_role` are mutable; `name` cannot be changed. Archived service accounts cannot be updated; this returns 400. Setting `organization_role` to `admin` (even when unchanged) requires an interactive credential (a user OAuth token or a Console session). #### Parameters - `serviceAccountID: string` (path parameter) ID of the service account to update. - `description?:optional string` Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string). - `organizationRole?:optional OrganizationRole` Replaces the org-level role. Omit or send `null` to leave unchanged. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class ServiceAccount` - `"service_account" type` - `string id` Tagged ID of the service account. - `?\Datetime archivedAt` If set, this service account is archived. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `\Datetime createdAt` When this service account was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `?string description` Optional free-text description. - `string name` Admin-chosen slug identifier. - `OrganizationRole organizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `\Datetime updatedAt` When this service account was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. #### Example ```php beta->organization->serviceAccounts->update( 'service_account_id', description: 'description', organizationRole: 'admin', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaServiceAccount); ``` ##### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ### Archive Service Account `$client->beta->organization->serviceAccounts->archive(string serviceAccountID, ?list betas): ServiceAccount` **POST** `/v1/organizations/service_accounts/{service_account_id}/archive` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Archive a service account. Idempotent; re-archiving returns the service account with its original `archived_at`. Rejected with 400 if any live (non-archived) federation rule still targets this service account, same as issuer archival; archive those rules first or change their target to another service account. #### Parameters - `serviceAccountID: string` (path parameter) ID of the service account to archive. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class ServiceAccount` - `"service_account" type` - `string id` Tagged ID of the service account. - `?\Datetime archivedAt` If set, this service account is archived. - `?string archivedByActorID` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `\Datetime createdAt` When this service account was created. - `?string createdByActorID` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `?string description` Optional free-text description. - `string name` Admin-chosen slug identifier. - `OrganizationRole organizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `\Datetime updatedAt` When this service account was last updated. - `?string updatedByActorID` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. #### Example ```php beta->organization->serviceAccounts->archive( 'service_account_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24] ); var_dump($betaServiceAccount); ``` ##### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Organization › Service Accounts › Workspaces ### Add Workspace To Service Account `$client->beta->organization->serviceAccounts->workspaces->add(string serviceAccountID, string workspaceID, NoBillingWorkspaceRole workspaceRole, ?list betas): ServiceAccountWorkspaceMember` **POST** `/v1/organizations/service_accounts/{service_account_id}/workspaces` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Add a service account to a workspace with the given `workspace_role`. Mirror of `POST /workspaces/{workspace_id}/service_accounts`, addressed from the service-account side; both create the same membership. If the service account is already an explicit member of the workspace, its `workspace_role` is replaced with the value supplied here. Archived workspaces return 400. Archived service accounts cannot be added and are rejected. #### Parameters - `serviceAccountID: string` (path parameter) ID of the service account. - `workspaceID: string` Tagged workspace ID to add the service account to. - `workspaceRole: NoBillingWorkspaceRole` Role to assign to the service account in this workspace. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class ServiceAccountWorkspaceMember` - `"service_account_workspace_member" type` - `?string createdByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `?bool implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `string serviceAccountID` Tagged service account ID (`svac_...`). - `string workspaceID` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole workspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. #### Example ```php beta ->organization ->serviceAccounts ->workspaces ->add( 'service_account_id', workspaceID: 'workspace_id', workspaceRole: NoBillingWorkspaceRole::WORKSPACE_ADMIN, betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaServiceAccountWorkspaceMember); ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### List Workspaces For Service Account `$client->beta->organization->serviceAccounts->workspaces->list(string serviceAccountID, ?int limit, ?string page, ?list betas): PageCursor` **GET** `/v1/organizations/service_accounts/{service_account_id}/workspaces` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). List the workspaces a service account is a member of. Each entry includes the service account's `workspace_role` in that workspace. Use `limit` and the `next_page` cursor to paginate. When the service account has no explicit default-workspace membership, the implicit (`implicit: true`) membership is returned as the first entry on the first page; with `limit=1` the first page may return up to 2 entries (the implicit entry plus one explicit membership) so a pagination cursor can be derived. Memberships are returned only while the service account is active. Without a `page` cursor, an archived service account returns an empty list. A `page` cursor that does not match an active membership returns a 400 invalid-request error. A cursor stops matching when the membership is removed, the workspace is deleted, or the service account is archived. Restart pagination from the first page to recover. #### Parameters - `serviceAccountID: string` (path parameter) ID of the service account. - `limit?:optional int` (query parameter) Number of results per page. default: 20 - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page`. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class ServiceAccountWorkspaceMember` - `"service_account_workspace_member" type` - `?string createdByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `?bool implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `string serviceAccountID` Tagged service account ID (`svac_...`). - `string workspaceID` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole workspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. #### Example ```php beta->organization->serviceAccounts->workspaces->list( 'service_account_id', limit: 1, page: 'page', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ], "next_page": "next_page" } ``` ### Remove Workspace From Service Account `$client->beta->organization->serviceAccounts->workspaces->remove(string workspaceID, string serviceAccountID, ?list betas): WorkspaceRemoveResponse` **DELETE** `/v1/organizations/service_accounts/{service_account_id}/workspaces/{workspace_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Remove a service account from a workspace. Mirror of `DELETE /workspaces/{workspace_id}/service_accounts/{service_account_id}`, addressed from the service-account side. Removal is idempotent (returns 200 even if the membership was already removed). A DELETE against the implicit default-workspace membership returns 200 but is a no-op and the membership persists; deleting an explicit default-workspace row reverts to the implicit `workspace_user` membership. Archived workspaces return 400. #### Parameters - `serviceAccountID: string` (path parameter) ID of the service account. - `workspaceID: string` (path parameter) ID of the workspace. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class WorkspaceRemoveResponse` - `"service_account_workspace_member_deleted" type` - `string serviceAccountID` Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op. - `string workspaceID` Tagged workspace ID (`wrkspc_...`) named in the delete request. #### Example ```php beta->organization->serviceAccounts->workspaces->remove( 'workspace_id', serviceAccountID: 'service_account_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($workspace); ``` ##### Response (200) ```json { "service_account_id": "service_account_id", "type": "service_account_workspace_member_deleted", "workspace_id": "workspace_id" } ``` ## Organization › Users ### List Users `$client->beta->organization->users->list(?string afterID, ?string beforeID, ?string email, ?int limit, ?list roles): Page` **GET** `/v1/organizations/users` List the organization's members. #### Parameters - `afterID?:optional string` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `beforeID?:optional string` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `email?:optional string` (query parameter) Filter by user email. - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. default: 20 - `roles?:optional list` (query parameter) Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together. Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`. #### Returns - `class OrganizationUser` - `"user" type` Object type. For Users, this is always `"user"`. - `string id` ID of the User. - `\Datetime addedAt` RFC 3339 datetime string indicating when the User joined the Organization. - `string email` Email of the User. - `string name` Name of the User. - `BetaOrganizationRole role` Organization role of the User. #### Example ```php beta->organization->users->list( afterID: 'after_id', beforeID: 'before_id', email: 'dev@stainless.com', limit: 1, roles: ['string'], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "added_at": "2024-10-30T23:58:27.427722Z", "email": "user@emaildomain.com", "name": "Jane Doe", "role": "admin", "type": "user" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ### Get User `$client->beta->organization->users->retrieve(string userID): OrganizationUser` **GET** `/v1/organizations/users/{user_id}` Retrieve a member of the organization by user ID. #### Parameters - `userID: string` (path parameter) ID of the User. #### Returns - `class OrganizationUser` - `"user" type` Object type. For Users, this is always `"user"`. - `string id` ID of the User. - `\Datetime addedAt` RFC 3339 datetime string indicating when the User joined the Organization. - `string email` Email of the User. - `string name` Name of the User. - `BetaOrganizationRole role` Organization role of the User. #### Example ```php beta->organization->users->retrieve('user_id'); var_dump($betaOrganizationUser); ``` ##### Response (200) ```json { "id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "added_at": "2024-10-30T23:58:27.427722Z", "email": "user@emaildomain.com", "name": "Jane Doe", "role": "admin", "type": "user" } ``` ### Update User `$client->beta->organization->users->update(string userID, Role role): OrganizationUser` **POST** `/v1/organizations/users/{user_id}` Update a member's organization role. #### Parameters - `userID: string` (path parameter) ID of the User. - `role: Role` New role for the User. The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations accept `user` and `managed`; changing a User's role to `managed` requires the `write:rbac_groups` scope in addition to `write:members`. #### Returns - `class OrganizationUser` - `"user" type` Object type. For Users, this is always `"user"`. - `string id` ID of the User. - `\Datetime addedAt` RFC 3339 datetime string indicating when the User joined the Organization. - `string email` Email of the User. - `string name` Name of the User. - `BetaOrganizationRole role` Organization role of the User. #### Example ```php beta->organization->users->update( 'user_id', role: 'user' ); var_dump($betaOrganizationUser); ``` ##### Response (200) ```json { "id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "added_at": "2024-10-30T23:58:27.427722Z", "email": "user@emaildomain.com", "name": "Jane Doe", "role": "admin", "type": "user" } ``` ### Remove User `$client->beta->organization->users->remove(string userID): UserRemoveResponse` **DELETE** `/v1/organizations/users/{user_id}` Remove a member from the organization. #### Parameters - `userID: string` (path parameter) ID of the User. #### Returns - `class UserRemoveResponse` - `"user_deleted" type` Deleted object type. For Users, this is always `"user_deleted"`. - `string id` ID of the User. #### Example ```php beta->organization->users->remove('user_id'); var_dump($user); ``` ##### Response (200) ```json { "id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "type": "user_deleted" } ``` ## Organization › Workspaces ### List Workspaces `$client->beta->organization->workspaces->list(?string afterID, ?string beforeID, ?bool includeArchived, ?bool includeDefault, ?int limit): Page` **GET** `/v1/organizations/workspaces` List Workspaces #### Parameters - `afterID?:optional string` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `beforeID?:optional string` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `includeArchived?:optional bool` (query parameter) Whether to include Workspaces that have been archived in the response default: false - `includeDefault?:optional bool` (query parameter) Whether to include the organization's default Workspace in the response default: false - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. default: 20 #### Returns - `class Workspace` - `"workspace" type` Object type. For Workspaces, this is always `"workspace"`. - `string id` ID of the Workspace. - `?\Datetime archivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. - `string compartmentID` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `\Datetime createdAt` RFC 3339 datetime string indicating when the Workspace was created. - `DataResidency dataResidency` Data residency configuration. - `string displayColor` Hex color code representing the Workspace in the Anthropic Console. - `?string externalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `string name` Name of the Workspace. - `array tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. #### Example ```php beta->organization->workspaces->list( afterID: 'after_id', beforeID: 'before_id', includeArchived: true, includeDefault: true, limit: 1, ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ### Create Workspace `$client->beta->organization->workspaces->create(string name, ?DataResidencyCreateConfig dataResidency, ?string displayColor, ?string externalKeyID, ?array tags, ?list betas): Workspace` **POST** `/v1/organizations/workspaces` Create Workspace #### Parameters - `name: string` Name of the Workspace. - `dataResidency?:optional DataResidencyCreateConfig` Data residency configuration for the workspace. If omitted, defaults to `workspace_geo: "us"`, `allowed_inference_geos: "unrestricted"`, and `default_inference_geo: "global"`. - `displayColor?:optional string` Hex color code representing the Workspace in the Anthropic Console. - `externalKeyID?:optional string` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `tags?:optional array` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class Workspace` - `"workspace" type` Object type. For Workspaces, this is always `"workspace"`. - `string id` ID of the Workspace. - `?\Datetime archivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. - `string compartmentID` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `\Datetime createdAt` RFC 3339 datetime string indicating when the Workspace was created. - `DataResidency dataResidency` Data residency configuration. - `string displayColor` Hex color code representing the Workspace in the Anthropic Console. - `?string externalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `string name` Name of the Workspace. - `array tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. #### Example ```php beta->organization->workspaces->create( name: 'x', dataResidency: [ 'allowedInferenceGeos' => 'unrestricted', 'defaultInferenceGeo' => 'global', 'workspaceGeo' => 'us', ], displayColor: '#6C5BB9', externalKeyID: 'ekey_01SDCCSbTxrXDpWc1phhtcfK', tags: ['env' => 'prod', 'team' => 'platform'], betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaWorkspace); ``` ##### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ``` ### Get Workspace `$client->beta->organization->workspaces->retrieve(string workspaceID): Workspace` **GET** `/v1/organizations/workspaces/{workspace_id}` Get Workspace #### Parameters - `workspaceID: string` (path parameter) ID of the Workspace. #### Returns - `class Workspace` - `"workspace" type` Object type. For Workspaces, this is always `"workspace"`. - `string id` ID of the Workspace. - `?\Datetime archivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. - `string compartmentID` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `\Datetime createdAt` RFC 3339 datetime string indicating when the Workspace was created. - `DataResidency dataResidency` Data residency configuration. - `string displayColor` Hex color code representing the Workspace in the Anthropic Console. - `?string externalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `string name` Name of the Workspace. - `array tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. #### Example ```php beta->organization->workspaces->retrieve( 'workspace_id' ); var_dump($betaWorkspace); ``` ##### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ``` ### Update Workspace `$client->beta->organization->workspaces->update(string workspaceID, ?DataResidencyUpdateConfig dataResidency, ?string displayColor, ?string externalKeyID, ?string name, ?array tags): Workspace` **POST** `/v1/organizations/workspaces/{workspace_id}` Update Workspace #### Parameters - `workspaceID: string` (path parameter) - `dataResidency?:optional DataResidencyUpdateConfig` Data residency configuration for the workspace. - `displayColor?:optional string` Hex color code representing the Workspace in the Anthropic Console. - `externalKeyID?:optional string` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `name?:optional string` Name of the Workspace. - `tags?:optional array` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. #### Returns - `class Workspace` - `"workspace" type` Object type. For Workspaces, this is always `"workspace"`. - `string id` ID of the Workspace. - `?\Datetime archivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. - `string compartmentID` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `\Datetime createdAt` RFC 3339 datetime string indicating when the Workspace was created. - `DataResidency dataResidency` Data residency configuration. - `string displayColor` Hex color code representing the Workspace in the Anthropic Console. - `?string externalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `string name` Name of the Workspace. - `array tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. #### Example ```php beta->organization->workspaces->update( 'workspace_id', dataResidency: [ 'allowedInferenceGeos' => 'unrestricted', 'defaultInferenceGeo' => 'global' ], displayColor: '#6C5BB9', externalKeyID: 'ekey_01SDCCSbTxrXDpWc1phhtcfK', name: 'x', tags: ['env' => 'prod', 'team' => 'platform'], ); var_dump($betaWorkspace); ``` ##### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ``` ### Archive Workspace `$client->beta->organization->workspaces->archive(string workspaceID): Workspace` **POST** `/v1/organizations/workspaces/{workspace_id}/archive` Archive Workspace #### Parameters - `workspaceID: string` (path parameter) #### Returns - `class Workspace` - `"workspace" type` Object type. For Workspaces, this is always `"workspace"`. - `string id` ID of the Workspace. - `?\Datetime archivedAt` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. - `string compartmentID` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `\Datetime createdAt` RFC 3339 datetime string indicating when the Workspace was created. - `DataResidency dataResidency` Data residency configuration. - `string displayColor` Hex color code representing the Workspace in the Anthropic Console. - `?string externalKeyID` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `string name` Name of the Workspace. - `array tags` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. #### Example ```php beta->organization->workspaces->archive( 'workspace_id' ); var_dump($betaWorkspace); ``` ##### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ``` ## Organization › Workspaces › Rate Limits ### List Workspace Rate Limits `$client->beta->organization->workspaces->rateLimits->list(string workspaceID, ?GroupType groupType, ?bool includeInherited, ?int limit, ?string page): PageCursor` **GET** `/v1/organizations/workspaces/{workspace_id}/rate_limits` List a workspace's rate limits. By default, returns only the groups and limiter types that have a workspace-level override. With `include_inherited=true`, returns every group with organization-level limits the workspace can see, listing for each the values it inherits from the organization as well as its own overrides. Each value's `source` says which it is. When `limit` is omitted, every matching entry is returned in a single page; when `limit` truncates the result, follow `next_page` to fetch the remaining entries. #### Parameters - `workspaceID: string` (path parameter) The ID of the workspace. - `groupType?:optional GroupType` (query parameter) Filter by group type. - `includeInherited?:optional bool` (query parameter) Also list the limiter values the workspace inherits from the organization, including groups with no workspace-level override. default: false - `limit?:optional int` (query parameter) Maximum number of items to return per page. Ranges from `1` to `1000`. When omitted, every remaining entry is returned in a single page and `next_page` is `null`. - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class BetaWorkspaceRateLimit` - `"workspace_rate_limit" type` Object type. Always `workspace_rate_limit` for workspace rate-limit entries. - `Group group` The rate-limit group this entry's limits apply to. - `list limits` The workspace's limiter values for this group. By default only the limiter types with a workspace-level override are listed. With `include_inherited` set to `true`, the limiter types the workspace inherits from the organization are listed too, each marked by `source`. - `?list models` Model names this entry's limits apply to, including aliases. `null` when `group.type` is not `"model_group"`. The list covers the models this workspace has access to, so it can differ between workspaces. - `string rateLimitID` The `id` of the organization's RateLimit entry this entry applies to. - `string workspaceID` ID of the Workspace this entry applies to. #### Example ```php beta->organization->workspaces->rateLimits->list( 'workspace_id', groupType: 'batch', includeInherited: true, limit: 1, page: 'page', ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "group": { "id": "id", "display_name": "display_name", "type": "model_group" }, "limits": [ { "org_limit": 0, "source": { "type": "workspace" }, "type": "type", "value": 0 } ], "models": [ "string" ], "rate_limit_id": "rate_limit_id", "type": "workspace_rate_limit", "workspace_id": "workspace_id" } ], "next_page": "next_page" } ``` ### Set Workspace Rate Limits `$client->beta->organization->workspaces->rateLimits->update(string rateLimitID, string workspaceID, list limits): BetaWorkspaceRateLimit` **POST** `/v1/organizations/workspaces/{workspace_id}/rate_limits/{rate_limit_id}` Set or clear rate-limit overrides for one rate-limit group in a workspace. Only the limiter types named in `limits` change: an integer `value` sets that type's override and `null` clears it. Types not named keep their current value. A value above the organization's own limit is stored, but the organization limit still applies, so the lower of the two is enforced. Returns the targeted group's entry with this request applied, in the shape `GET /v1/organizations/workspaces/{workspace_id}/rate_limits` returns. Changes take effect within about an hour. #### Parameters - `workspaceID: string` (path parameter) The ID of the workspace. - `rateLimitID: string` (path parameter) The `id` of the organization's rate-limit entry to set overrides for. - `limits: list` Limits to set or clear. Unspecified limit types are unchanged. #### Returns - `class BetaWorkspaceRateLimit` - `"workspace_rate_limit" type` Object type. Always `workspace_rate_limit` for workspace rate-limit entries. - `Group group` The rate-limit group this entry's limits apply to. - `list limits` The workspace's limiter values for this group. By default only the limiter types with a workspace-level override are listed. With `include_inherited` set to `true`, the limiter types the workspace inherits from the organization are listed too, each marked by `source`. - `?list models` Model names this entry's limits apply to, including aliases. `null` when `group.type` is not `"model_group"`. The list covers the models this workspace has access to, so it can differ between workspaces. - `string rateLimitID` The `id` of the organization's RateLimit entry this entry applies to. - `string workspaceID` ID of the Workspace this entry applies to. #### Example ```php beta ->organization ->workspaces ->rateLimits ->update( 'rate_limit_id', workspaceID: 'workspace_id', limits: [['type' => BetaWorkspaceRateLimitType::FAST_ITPMCA, 'value' => 0]], ); var_dump($betaWorkspaceRateLimit); ``` ##### Response (200) ```json { "group": { "id": "id", "display_name": "display_name", "type": "model_group" }, "limits": [ { "org_limit": 0, "source": { "type": "workspace" }, "type": "type", "value": 0 } ], "models": [ "string" ], "rate_limit_id": "rate_limit_id", "type": "workspace_rate_limit", "workspace_id": "workspace_id" } ``` ## Organization › Workspaces › Members ### List Workspace Members `$client->beta->organization->workspaces->members->list(string workspaceID, ?string afterID, ?string beforeID, ?int limit): Page` **GET** `/v1/organizations/workspaces/{workspace_id}/members` List Workspace Members #### Parameters - `workspaceID: string` (path parameter) ID of the Workspace. - `afterID?:optional string` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `beforeID?:optional string` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. default: 20 #### Returns - `class WorkspaceMember` - `"workspace_member" type` Object type. For Workspace Members, this is always `"workspace_member"`. - `string userID` ID of the User. - `string workspaceID` ID of the Workspace. - `WorkspaceRole workspaceRole` Role of the Workspace Member. #### Example ```php beta->organization->workspaces->members->list( 'workspace_id', afterID: 'after_id', beforeID: 'before_id', limit: 1 ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "type": "workspace_member", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ### Create Workspace Member `$client->beta->organization->workspaces->members->add(string workspaceID, string userID, NoBillingWorkspaceRole workspaceRole): WorkspaceMember` **POST** `/v1/organizations/workspaces/{workspace_id}/members` Create Workspace Member #### Parameters - `workspaceID: string` (path parameter) ID of the Workspace. - `userID: string` ID of the User. - `workspaceRole: NoBillingWorkspaceRole` Role of the new Workspace Member. Cannot be `workspace_billing`. #### Returns - `class WorkspaceMember` - `"workspace_member" type` Object type. For Workspace Members, this is always `"workspace_member"`. - `string userID` ID of the User. - `string workspaceID` ID of the Workspace. - `WorkspaceRole workspaceRole` Role of the Workspace Member. #### Example ```php beta->organization->workspaces->members->add( 'workspace_id', userID: 'user_01WCz1FkmYMm4gnmykNKUu3Q', workspaceRole: NoBillingWorkspaceRole::WORKSPACE_ADMIN, ); var_dump($betaWorkspaceMember); ``` ##### Response (200) ```json { "type": "workspace_member", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ``` ### Get Workspace Member `$client->beta->organization->workspaces->members->retrieve(string userID, string workspaceID): WorkspaceMember` **GET** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}` Get Workspace Member #### Parameters - `workspaceID: string` (path parameter) ID of the Workspace. - `userID: string` (path parameter) ID of the User. #### Returns - `class WorkspaceMember` - `"workspace_member" type` Object type. For Workspace Members, this is always `"workspace_member"`. - `string userID` ID of the User. - `string workspaceID` ID of the Workspace. - `WorkspaceRole workspaceRole` Role of the Workspace Member. #### Example ```php beta ->organization ->workspaces ->members ->retrieve('user_id', workspaceID: 'workspace_id'); var_dump($betaWorkspaceMember); ``` ##### Response (200) ```json { "type": "workspace_member", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ``` ### Update Workspace Member `$client->beta->organization->workspaces->members->update(string userID, string workspaceID, WorkspaceRole workspaceRole): WorkspaceMember` **POST** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}` Update Workspace Member #### Parameters - `workspaceID: string` (path parameter) ID of the Workspace. - `userID: string` (path parameter) ID of the User. - `workspaceRole: WorkspaceRole` New workspace role for the User. #### Returns - `class WorkspaceMember` - `"workspace_member" type` Object type. For Workspace Members, this is always `"workspace_member"`. - `string userID` ID of the User. - `string workspaceID` ID of the Workspace. - `WorkspaceRole workspaceRole` Role of the Workspace Member. #### Example ```php beta->organization->workspaces->members->update( 'user_id', workspaceID: 'workspace_id', workspaceRole: WorkspaceRole::WORKSPACE_ADMIN, ); var_dump($betaWorkspaceMember); ``` ##### Response (200) ```json { "type": "workspace_member", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ``` ### Delete Workspace Member `$client->beta->organization->workspaces->members->remove(string userID, string workspaceID): MemberRemoveResponse` **DELETE** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}` Delete Workspace Member #### Parameters - `workspaceID: string` (path parameter) ID of the Workspace. - `userID: string` (path parameter) ID of the User. #### Returns - `class MemberRemoveResponse` - `"workspace_member_deleted" type` Deleted object type. For Workspace Members, this is always `"workspace_member_deleted"`. - `string userID` ID of the User. - `string workspaceID` ID of the Workspace. #### Example ```php beta->organization->workspaces->members->remove( 'user_id', workspaceID: 'workspace_id' ); var_dump($member); ``` ##### Response (200) ```json { "type": "workspace_member_deleted", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" } ``` ## Organization › Workspaces › Service Accounts ### List Service Account Workspace Members `$client->beta->organization->workspaces->serviceAccounts->list(string workspaceID, ?int limit, ?string page, ?list betas): PageCursor` **GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). List the service accounts that are members of a workspace. Each entry includes the service account's `workspace_role`. Use `limit` and the `next_page` cursor to paginate. Archived workspaces return 400; use `GET /service_accounts/{id}/workspaces` to audit memberships of an archived workspace. The implicit default-workspace membership is not included in this list. Memberships of archived service accounts are omitted from the results. #### Parameters - `workspaceID: string` (path parameter) ID of the workspace. - `limit?:optional int` (query parameter) Number of results per page. default: 20 - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page`. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class ServiceAccountWorkspaceMember` - `"service_account_workspace_member" type` - `?string createdByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `?bool implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `string serviceAccountID` Tagged service account ID (`svac_...`). - `string workspaceID` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole workspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. #### Example ```php beta->organization->workspaces->serviceAccounts->list( 'workspace_id', limit: 1, page: 'page', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ], "next_page": "next_page" } ``` ### Create Service Account Workspace Member `$client->beta->organization->workspaces->serviceAccounts->add(string workspaceID, string serviceAccountID, NoBillingWorkspaceRole workspaceRole, ?list betas): ServiceAccountWorkspaceMember` **POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Add a service account to a workspace with the given `workspace_role`. The role determines what the service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user` member of the default workspace; adding it explicitly assigns a chosen role. If the service account is already an explicit member of the workspace, its `workspace_role` is replaced with the value supplied here. Archived workspaces return 400. Archived service accounts cannot be added and are rejected. #### Parameters - `workspaceID: string` (path parameter) ID of the workspace. - `serviceAccountID: string` Tagged service account ID to add. - `workspaceRole: NoBillingWorkspaceRole` Role to assign to the service account in this workspace. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class ServiceAccountWorkspaceMember` - `"service_account_workspace_member" type` - `?string createdByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `?bool implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `string serviceAccountID` Tagged service account ID (`svac_...`). - `string workspaceID` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole workspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. #### Example ```php beta ->organization ->workspaces ->serviceAccounts ->add( 'workspace_id', serviceAccountID: 'service_account_id', workspaceRole: NoBillingWorkspaceRole::WORKSPACE_ADMIN, betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaServiceAccountWorkspaceMember); ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### Get Service Account Workspace Member `$client->beta->organization->workspaces->serviceAccounts->retrieve(string serviceAccountID, string workspaceID, ?list betas): ServiceAccountWorkspaceMember` **GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Retrieve a service account's membership in a workspace. Returns the membership record, including the service account's `workspace_role` in this workspace. Archived workspaces return 400. For the default workspace, returns the implicit (`implicit: true`) membership when no explicit membership exists; an explicitly added membership is returned with its assigned role. An archived service account returns 404. #### Parameters - `workspaceID: string` (path parameter) ID of the workspace. - `serviceAccountID: string` (path parameter) ID of the service account. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class ServiceAccountWorkspaceMember` - `"service_account_workspace_member" type` - `?string createdByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `?bool implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `string serviceAccountID` Tagged service account ID (`svac_...`). - `string workspaceID` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole workspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. #### Example ```php beta ->organization ->workspaces ->serviceAccounts ->retrieve( 'service_account_id', workspaceID: 'workspace_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaServiceAccountWorkspaceMember); ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### Update Service Account Workspace Member `$client->beta->organization->workspaces->serviceAccounts->update(string serviceAccountID, string workspaceID, NoBillingWorkspaceRole workspaceRole, ?list betas): ServiceAccountWorkspaceMember` **POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Change a service account's role in a workspace. The new `workspace_role` replaces the current one. Only explicit memberships can be updated; to set a role on the implicit default-workspace membership, add the service account explicitly with `POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces return 400. Archived service accounts cannot be updated and are rejected. #### Parameters - `workspaceID: string` (path parameter) ID of the workspace. - `serviceAccountID: string` (path parameter) ID of the service account. - `workspaceRole: NoBillingWorkspaceRole` New role for the service account in this workspace. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class ServiceAccountWorkspaceMember` - `"service_account_workspace_member" type` - `?string createdByActorID` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `?bool implicit` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `string serviceAccountID` Tagged service account ID (`svac_...`). - `string workspaceID` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole workspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. #### Example ```php beta ->organization ->workspaces ->serviceAccounts ->update( 'service_account_id', workspaceID: 'workspace_id', workspaceRole: NoBillingWorkspaceRole::WORKSPACE_ADMIN, betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaServiceAccountWorkspaceMember); ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### Delete Service Account Workspace Member `$client->beta->organization->workspaces->serviceAccounts->remove(string serviceAccountID, string workspaceID, ?list betas): ServiceAccountRemoveResponse` **DELETE** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php). Remove a service account from a workspace. Removal is idempotent (returns 200 even if the membership was already removed). A DELETE against the implicit default-workspace membership returns 200 but is a no-op and the membership persists; deleting an explicit default-workspace row reverts to the implicit `workspace_user` membership. Archived workspaces return 400. #### Parameters - `workspaceID: string` (path parameter) ID of the workspace. - `serviceAccountID: string` (path parameter) ID of the service account. - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class ServiceAccountRemoveResponse` - `"service_account_workspace_member_deleted" type` - `string serviceAccountID` Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op. - `string workspaceID` Tagged workspace ID (`wrkspc_...`) named in the delete request. #### Example ```php beta ->organization ->workspaces ->serviceAccounts ->remove( 'service_account_id', workspaceID: 'workspace_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($serviceAccount); ``` ##### Response (200) ```json { "service_account_id": "service_account_id", "type": "service_account_workspace_member_deleted", "workspace_id": "workspace_id" } ``` ## Organization › Rate Limits ### List Organization Rate Limits `$client->beta->organization->rateLimits->list(?GroupType groupType, ?int limit, ?string model, ?string page): PageCursor` **GET** `/v1/organizations/rate_limits` List Messages API rate limits for your organization. Each entry corresponds to one rate-limit group (either a model family or an API-surface category such as the Message Batches API or the web search tool) and contains the set of limiter values that apply to it. When `limit` is omitted, every matching entry is returned in a single page; when `limit` truncates the result, follow `next_page` to fetch the remaining entries. #### Parameters - `groupType?:optional GroupType` (query parameter) Filter by group type. - `limit?:optional int` (query parameter) Maximum number of items to return per page. Ranges from `1` to `1000`. When omitted, every remaining entry is returned in a single page and `next_page` is `null`. - `model?:optional string` (query parameter) Filter to the single entry containing this model. Accepts full model names and aliases. Returns 404 if the model is not found or has no rate limits for this organization. - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `class OrganizationRateLimit` - `"rate_limit" type` Object type. Always `rate_limit` for organization rate-limit entries. - `string id` Identifier of this rate-limit entry. It is stable within the organization and differs between organizations; the group's own identifier is `group.id`. Pass it as `rate_limit_id` to set a workspace's overrides for this group. - `Group group` The rate-limit group this entry's limits apply to. - `list limits` The limiter values that apply to this group. - `?list models` Model names this entry's limits apply to, including aliases. `null` when `group.type` is not `"model_group"`. The list covers the models your organization has access to, so it can differ between organizations. #### Example ```php beta->organization->rateLimits->list( groupType: 'batch', limit: 1, model: 'model', page: 'page' ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "id", "group": { "id": "id", "display_name": "display_name", "type": "model_group" }, "limits": [ { "type": "type", "value": 0 } ], "models": [ "string" ], "type": "rate_limit" } ], "next_page": "next_page" } ``` ## Organization › Compliance Settings ### Get Compliance Settings `$client->beta->organization->complianceSettings->retrieve(): ComplianceSettings` **GET** `/v1/organizations/compliance_settings` Retrieve your organization's Compliance Settings. Compliance Settings is a singleton resource: there is exactly one per organization, addressed without an identifier. The `state` field reflects whether the Compliance API is enabled. An organization with a parent organization reads the state inherited from the parent's configuration. #### Returns - `class ComplianceSettings` - `"compliance_settings" type` - `ComplianceSettingsState state` Whether the Compliance API is enabled for this organization. #### Example ```php beta ->organization ->complianceSettings ->retrieve(); var_dump($betaComplianceSettings); ``` ##### Response (200) ```json { "state": { "type": "enabled" }, "type": "compliance_settings" } ``` ### Update Compliance Settings `$client->beta->organization->complianceSettings->update(ComplianceSettingsStateParam state): ComplianceSettings` **POST** `/v1/organizations/compliance_settings` Update your organization's Compliance Settings. Setting `state` to `enabled` turns on the Compliance API and begins capturing organization activity events. Setting it to `disabled` turns both off. `state` reflects whether the Compliance API is enabled. A request that sets `state` to its current value succeeds and leaves the resource unchanged. A `disabled` request stays in effect until a later `enabled` request or the organization's next provisioning action that enables Access Transparency: enabling Access Transparency also enables the Compliance API, which serves its activity events, so such provisioning (including re-runs) re-enables the Compliance API even after a `disabled` request. Automated provisioning never disables compliance settings. #### Parameters - `state: ComplianceSettingsStateParam` Desired state. Accepts the string shorthand "enabled" or "disabled" in place of the object form; the response always returns the canonical object form. #### Returns - `class ComplianceSettings` - `"compliance_settings" type` - `ComplianceSettingsState state` Whether the Compliance API is enabled for this organization. #### Example ```php beta ->organization ->complianceSettings ->update(state: ['type' => 'enabled']); var_dump($betaComplianceSettings); ``` ##### Response (200) ```json { "state": { "type": "enabled" }, "type": "compliance_settings" } ``` ## Organization › Analytics › Summaries ### Get Activity Summaries `$client->beta->organization->analytics->summaries->list(\Datetime startingDate, ?\Datetime endingDate, ?list filter, ?int limit, ?string page): PageCursor` **GET** `/v1/organizations/analytics/summaries` Get organization-wide activity summaries for a date range. Returns one entry per day from `starting_date` (inclusive) to `ending_date` (exclusive) in `data`, the same `data` / `next_page` envelope as the other analytics list endpoints; the series is currently returned in full, so `next_page` is always null. Data is typically available with a 1-day lag and may be revised by a few percent over the following days: when `ending_date` is omitted it defaults to the most recent available day + 1, so the last entry covers the most recent available day. The series can be scoped to an RBAC group via `filter[]=rbac_group_id:{id}`. Available to organizations on a Claude Enterprise plan. Requires an API key with the `read:analytics` scope. #### Parameters - `startingDate: \Datetime` (query parameter) UTC date in YYYY-MM-DD format. Start of the date range (inclusive). Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. - `endingDate?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. End of the date range (exclusive). Data is typically available with a 1-day lag, so this can be at most today — which is also the default when omitted, making the last entry cover the most recent available day. Data may be revised by a few percent over the following days. The range may span at most 366 days. - `filter?:optional list` (query parameter) Filters as `dimension:value`. Only `rbac_group_id` is supported (e.g. `filter[]=rbac_group_id:{id}`); repeat the param to OR across groups. Scopes the whole day series to members of the matching group(s), re-aggregated from member-level activity — org-wide seat/invite fields and the adoption rates derived from them are null on scoped rows. `rbac_group_id` accepts the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each UTC day (time-of-usage attribution). At most 100 entries. - `limit?:optional int` (query parameter) Number of results per page (1-1000, default 100). The day series (at most 366 entries) is currently returned in full in a single page, so `limit` does not yet shorten it. - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page` field. `next_page` is currently always null, so there is never a cursor to send. #### Returns - `class AnalyticsSingleDayActivitySummary` - `?int assignedSeatCount` Number of seats currently assigned to members. Null when the response is scoped to an RBAC group — seat assignment is org-wide and has no per-group analogue. - `int coworkDailyActiveUserCount` Number of users with Cowork activity on the requested day - `int coworkMonthlyActiveUserCount` Number of users with Cowork activity in the 30-day rolling window - `int coworkWeeklyActiveUserCount` Number of users with Cowork activity in the 7-day rolling window - `int dailyActiveUserCount` Number of users with token consumption on the requested day - `?float dailyAdoptionRate` Percentage of assigned seats with activity on the requested day (`DAU / assigned_seat_count * 100`). Null when the response is scoped to an RBAC group. - `\Datetime endingAt` End of the aggregation period (exclusive), UTC midnight in RFC 3339 format (e.g. `2026-01-16T00:00:00Z`). - `int monthlyActiveUserCount` Number of users with token consumption in the 30-day rolling window - `?float monthlyAdoptionRate` Percentage of assigned seats with activity in the 30-day rolling window (`MAU / assigned_seat_count * 100`). Null when the response is scoped to an RBAC group. - `?int pendingInviteCount` Number of pending invitations to join the organization. Null when the response is scoped to an RBAC group. - `\Datetime startingAt` Start of the aggregation period (inclusive), UTC midnight in RFC 3339 format (e.g. `2026-01-15T00:00:00Z`). - `int weeklyActiveUserCount` Number of users with token consumption in the 7-day rolling window - `?float weeklyAdoptionRate` Percentage of assigned seats with activity in the 7-day rolling window (`WAU / assigned_seat_count * 100`). Null when the response is scoped to an RBAC group. - `?int chatCoworkUnifiedDailyActiveUserCount` Number of users with activity in Chat and Cowork unified on the requested day. Omitted from the response on deployments that do not offer Chat and Cowork unified. - `?int chatCoworkUnifiedMonthlyActiveUserCount` Number of users with activity in Chat and Cowork unified in the 28-day rolling window (30 days when the request filters by `rbac_group_id`). Omitted from the response on deployments that do not offer Chat and Cowork unified. - `?int chatCoworkUnifiedWeeklyActiveUserCount` Number of users with activity in Chat and Cowork unified in the 7-day rolling window. Omitted from the response on deployments that do not offer Chat and Cowork unified. - `?int chatDailyActiveUserCount` Number of users with claude.ai (chat) activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int chatMonthlyActiveUserCount` Number of users with claude.ai (chat) activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int chatWeeklyActiveUserCount` Number of users with claude.ai (chat) activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int claudeCodeDailyActiveUserCount` Number of users with Claude Code activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int claudeCodeMonthlyActiveUserCount` Number of users with Claude Code activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int claudeCodeWeeklyActiveUserCount` Number of users with Claude Code activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int claudeDesignDailyActiveUserCount` Number of users with Claude Design activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int claudeDesignMonthlyActiveUserCount` Number of users with Claude Design activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int claudeDesignWeeklyActiveUserCount` Number of users with Claude Design activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int officeAgentDailyActiveUserCount` Number of users with Claude in Office activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int officeAgentMonthlyActiveUserCount` Number of users with Claude in Office activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int officeAgentWeeklyActiveUserCount` Number of users with Claude in Office activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int scienceDailyActiveUserCount` Number of users with Claude Science activity on the requested day. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int scienceEntitledUserCount` Number of users with a Claude Science seat entitlement (per-seat RBAC) at the time of the daily snapshot. The funnel top; independent of the org-level Claude Science toggle. Null when the response is scoped to an RBAC group — entitlement is org-wide and has no per-group analogue. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int scienceMonthlyActiveUserCount` Number of users with Claude Science activity in the 30-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. - `?int scienceWeeklyActiveUserCount` Number of users with Claude Science activity in the 7-day rolling window. Omitted from the response while the per-product breakdown is not enabled for this organization. #### Example ```php beta->organization->analytics->summaries->list( startingDate: '2019-12-27', endingDate: '2019-12-27', filter: ['string'], limit: 1, page: 'page', ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "assigned_seat_count": 0, "cowork_daily_active_user_count": 0, "cowork_monthly_active_user_count": 0, "cowork_weekly_active_user_count": 0, "daily_active_user_count": 0, "daily_adoption_rate": 0, "ending_at": "2019-12-27T18:11:19.117Z", "monthly_active_user_count": 0, "monthly_adoption_rate": 0, "pending_invite_count": 0, "starting_at": "2019-12-27T18:11:19.117Z", "weekly_active_user_count": 0, "weekly_adoption_rate": 0, "chat_cowork_unified_daily_active_user_count": 0, "chat_cowork_unified_monthly_active_user_count": 0, "chat_cowork_unified_weekly_active_user_count": 0, "chat_daily_active_user_count": 0, "chat_monthly_active_user_count": 0, "chat_weekly_active_user_count": 0, "claude_code_daily_active_user_count": 0, "claude_code_monthly_active_user_count": 0, "claude_code_weekly_active_user_count": 0, "claude_design_daily_active_user_count": 0, "claude_design_monthly_active_user_count": 0, "claude_design_weekly_active_user_count": 0, "office_agent_daily_active_user_count": 0, "office_agent_monthly_active_user_count": 0, "office_agent_weekly_active_user_count": 0, "science_daily_active_user_count": 0, "science_entitled_user_count": 0, "science_monthly_active_user_count": 0, "science_weekly_active_user_count": 0 } ], "next_page": "next_page" } ``` ## Organization › Analytics › Users ### List User Activity `$client->beta->organization->analytics->users->list(?\Datetime date, ?\Datetime endingDate, ?list filter, ?list groupBy, ?int limit, ?Order order, ?string orderBy, ?string page, ?\Datetime startingDate): PageCursor` **GET** `/v1/organizations/analytics/users` Get per-user activity for a given day, with cursor-based pagination. Returns activity metrics for each user in the organization, sorted by email address. Use `group_by[]` for per-RBAC-group aggregates, or `filter[]` to scope results to specific members, groups, or a chat project. Available to organizations on a Claude Enterprise plan. Requires an API key with the `read:analytics` scope. #### Parameters - `date?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. The day to get user activity for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. - `endingDate?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`. - `filter?:optional list` (query parameter) Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `project_id`, `rbac_group_id`, `user_id`. Value forms: `project_id` takes a tagged project id (`claude_proj_...`); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. A `project_id` filter limits each member's row to their claude.ai chat activity in that project and cannot be combined with `group_by[]` or an `rbac_group_id` filter. On these rows, every count in `chat_cowork_unified_metrics.sessions` is 0, because sessions are not measured per project. On any day a member sent a chat message in Chat and Cowork unified, all of that member's project activity for the day is counted in `chat_cowork_unified_metrics.chat` instead of `chat_metrics`. - `groupBy?:optional list` (query parameter) Dimensions to break results out by (e.g. `group_by[]=rbac_group_id`). Supported on this endpoint: `rbac_group_id`. Rows are already per-member, so the one supported grouping aggregates them per RBAC group instead. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries. - `limit?:optional int` (query parameter) Number of results per page (1-1000, default 100). - `order?:optional Order` (query parameter) Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted. - `orderBy?:optional string` (query parameter) Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set). - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page` field. - `startingDate?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. #### Returns - `class AnalyticsUserActivity` - `AnalyticsChatMetrics chatMetrics` Claude.ai activity metrics for a single user on a given day. - `AnalyticsClaudeCodeMetrics claudeCodeMetrics` Claude Code activity metrics for a single user on a given day. - `AnalyticsCoworkMetrics coworkMetrics` Cowork activity metrics for a single user on a given day. - `AnalyticsDesignMetrics designMetrics` Claude Design activity metrics for a single user on a given day. - `AnalyticsOfficeMetrics officeMetrics` Office Agent activity metrics for a single user on a given day, broken out by Office product. - `AnalyticsScienceMetrics scienceMetrics` Claude Science activity metrics for a single user on a given day. - `int webSearchCount` Number of web searches performed - `?ChatCoworkUnifiedMetrics chatCoworkUnifiedMetrics` Activity recorded while the member had Chat and Cowork unified (Cowork's features inside claude.ai chat) turned on, split into `chat` (chat activity) and `sessions` (Cowork activity). Omitted from the response on deployments that do not offer Chat and Cowork unified. - `?int distinctUserCount` Number of distinct active users represented by this row. Only set for grouped rollups (`group_by[]`); null for per-user rows. In date-range mode, recomputed as an exact distinct count of the group's active members over the requested window, never a sum of per-day values. - `?\Datetime lastActivityDate` Most recent UTC day (YYYY-MM-DD) on which the user had any counted activity, within the requested window: equal to the requested `date` in single-day mode, and to the latest active day from `starting_date` (inclusive) to `ending_date` (exclusive) in date-range rollup mode — never a day earlier than the window start. On filtered requests (`filter[]`) only days matching the filter count: with `filter[]=rbac_group_id:{id}` it is the last day the user was active while a member of that group, consistent with the row's other metrics. On grouped (`group_by[]`) rows it is the latest day any member of the group was active (the requested `date` in single-day mode). Omitted from the response while last-activity reporting is not enabled for this organization. - `?string rbacGroupID` Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`. - `?string rbacGroupName` Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key. - `?AnalyticsUser user` The user this row describes. Null on rows aggregated across users. #### Example ```php beta->organization->analytics->users->list( date: '2019-12-27', endingDate: '2019-12-27', filter: ['string'], groupBy: ['rbac_group_id'], limit: 1, order: 'asc', orderBy: 'order_by', page: 'page', startingDate: '2019-12-27', ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "chat_metrics": { "connectors_used_count": 0, "distinct_artifacts_created_count": 0, "distinct_connectors_used_count": 0, "distinct_conversation_count": 0, "distinct_files_uploaded_count": 0, "distinct_projects_created_count": 0, "distinct_projects_used_count": 0, "distinct_shared_artifacts_viewed_count": 0, "distinct_skills_used_count": 0, "message_count": 0, "shared_conversations_viewed_count": 0, "thinking_message_count": 0 }, "claude_code_metrics": { "core_metrics": { "artifacts_created_count": 0, "commit_count": 0, "distinct_session_count": 0, "lines_of_code": { "added_count": 0, "removed_count": 0 }, "pull_request_count": 0 }, "tool_actions": { "edit_tool": { "accepted_count": 0, "rejected_count": 0 }, "multi_edit_tool": { "accepted_count": 0, "rejected_count": 0 }, "notebook_edit_tool": { "accepted_count": 0, "rejected_count": 0 }, "write_tool": { "accepted_count": 0, "rejected_count": 0 } } }, "cowork_metrics": { "action_count": 0, "artifacts_created_count": 0, "connectors_used_count": 0, "dispatch_turn_count": 0, "distinct_connectors_used_count": 0, "distinct_session_count": 0, "distinct_skills_used_count": 0, "message_count": 0, "skills_used_count": 0, "distinct_plugins_used_count": 0, "edit_tool_count": 0, "file_edit_count": 0, "multi_edit_tool_count": 0, "notebook_edit_tool_count": 0, "plugins_used_count": 0, "sessions_with_file_edits_count": 0, "write_tool_count": 0 }, "design_metrics": { "distinct_projects_created_count": 0, "distinct_projects_used_count": 0, "distinct_session_count": 0, "message_count": 0 }, "office_metrics": { "excel": { "connectors_used_count": 0, "distinct_connectors_used_count": 0, "distinct_session_count": 0, "distinct_skills_used_count": 0, "message_count": 0, "skills_used_count": 0 }, "outlook": { "connectors_used_count": 0, "distinct_connectors_used_count": 0, "distinct_session_count": 0, "distinct_skills_used_count": 0, "message_count": 0, "skills_used_count": 0 }, "powerpoint": { "connectors_used_count": 0, "distinct_connectors_used_count": 0, "distinct_session_count": 0, "distinct_skills_used_count": 0, "message_count": 0, "skills_used_count": 0 }, "word": { "connectors_used_count": 0, "distinct_connectors_used_count": 0, "distinct_session_count": 0, "distinct_skills_used_count": 0, "message_count": 0, "skills_used_count": 0 } }, "science_metrics": { "delegation_count": 0, "distinct_session_count": 0, "message_count": 0, "remote_compute_job_count": 0, "skills_used_count": 0 }, "web_search_count": 0, "chat_cowork_unified_metrics": { "chat": { "connectors_used_count": 0, "distinct_artifacts_created_count": 0, "distinct_connectors_used_count": 0, "distinct_conversation_count": 0, "distinct_files_uploaded_count": 0, "distinct_projects_created_count": 0, "distinct_projects_used_count": 0, "distinct_shared_artifacts_viewed_count": 0, "distinct_skills_used_count": 0, "message_count": 0, "shared_conversations_viewed_count": 0, "thinking_message_count": 0 }, "sessions": { "action_count": 0, "artifacts_created_count": 0, "connectors_used_count": 0, "dispatch_turn_count": 0, "distinct_connectors_used_count": 0, "distinct_plugins_used_count": 0, "distinct_session_count": 0, "distinct_skills_used_count": 0, "edit_tool_count": 0, "file_edit_count": 0, "message_count": 0, "multi_edit_tool_count": 0, "notebook_edit_tool_count": 0, "plugins_used_count": 0, "sessions_with_file_edits_count": 0, "skills_used_count": 0, "write_tool_count": 0 } }, "distinct_user_count": 0, "last_activity_date": "2019-12-27", "rbac_group_id": "rbac_group_id", "rbac_group_name": "rbac_group_name", "user": { "id": "id", "email_address": "email_address", "type": "user" } } ], "next_page": "next_page" } ``` ## Organization › Analytics › Apps › Chat › Projects ### Get Chat Project Usage `$client->beta->organization->analytics->apps->chat->projects->list(?\Datetime date, ?\Datetime endingDate, ?list filter, ?list groupBy, ?int limit, ?Order order, ?string orderBy, ?string page, ?\Datetime startingDate): PageCursor` **GET** `/v1/organizations/analytics/apps/chat/projects` Get per-project activity for a given day, with cursor-based pagination. Returns activity metrics for each project in the organization, sorted by project ID. Use `group_by[]` to break projects out per member or per RBAC group, and `filter[]` to scope results; the parameter descriptions list the supported dimensions. Available to organizations on a Claude Enterprise plan. Requires an API key with the `read:analytics` scope. #### Parameters - `date?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. The day to get project activity for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. - `endingDate?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`. - `filter?:optional list` (query parameter) Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `project_id`, `rbac_group_id`, `user_id`. Value forms: `project_id` takes a tagged project id (`claude_proj_...`); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. - `groupBy?:optional list` (query parameter) Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `rbac_group_id`, `user_id`. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries. - `limit?:optional int` (query parameter) Number of results per page (1-1000, default 100). - `order?:optional Order` (query parameter) Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted. - `orderBy?:optional string` (query parameter) Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set). - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page` field. - `startingDate?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. #### Returns - `class AnalyticsProjectActivity` - `int distinctUserCount` Number of distinct users who used the project on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values. - `int messageCount` Number of messages sent in the project on the requested day - `string projectID` Tagged project identifier (e.g. `claude_proj_...`) - `string projectName` Name of the project - `?\Datetime createdAt` Project creation timestamp in RFC 3339 format. Null if the project was deleted before attribution was recorded. - `?AnalyticsUser createdBy` User who created the project. Null if the project was deleted before attribution was recorded, or if the creator's account no longer exists. - `?int distinctConversationCount` Number of distinct conversations in the project. Null on aggregated rows where a distinct count cannot be computed. - `?string product` Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, `office_agent`, or `chat_cowork_unified` (Chat and Cowork unified). These are the canonical Cost & Usage product names; an `office_agent` row's per-surface breakdown is in its `office_metrics`. On `/plugins` only `cowork`, `claude_code` and `chat_cowork_unified` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, `cowork` and `chat_cowork_unified` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`. - `?string rbacGroupID` Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`. - `?string rbacGroupName` Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key. - `?string userID` Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`. #### Example ```php beta->organization->analytics->apps->chat->projects->list( date: '2019-12-27', endingDate: '2019-12-27', filter: ['string'], groupBy: ['rbac_group_id'], limit: 1, order: 'asc', orderBy: 'order_by', page: 'page', startingDate: '2019-12-27', ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "distinct_user_count": 0, "message_count": 0, "project_id": "project_id", "project_name": "project_name", "created_at": "2019-12-27T18:11:19.117Z", "created_by": { "id": "id", "email_address": "email_address", "type": "user" }, "distinct_conversation_count": 0, "product": "product", "rbac_group_id": "rbac_group_id", "rbac_group_name": "rbac_group_name", "user_id": "user_id" } ], "next_page": "next_page" } ``` ## Organization › Analytics › Connectors ### Get Connector Usage `$client->beta->organization->analytics->connectors->list(?\Datetime date, ?\Datetime endingDate, ?list filter, ?list groupBy, ?int limit, ?Order order, ?string orderBy, ?string page, ?\Datetime startingDate): PageCursor` **GET** `/v1/organizations/analytics/connectors` Get per-connector usage for a given day, with cursor-based pagination. Returns connector usage metrics for the organization, sorted by connector name. Connector names are normalized from their various sources — for example, "Atlassian MCP server" and "mcp-atlassian" both appear as "atlassian". Use `group_by[]` to break usage out per member, per RBAC group, or per product surface, and `filter[]` to scope results; the parameter descriptions list the supported dimensions. Available to organizations on a Claude Enterprise plan. Requires an API key with the `read:analytics` scope. #### Parameters - `date?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. The day to get connector usage for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. - `endingDate?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`. - `filter?:optional list` (query parameter) Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `connector_name`, `product`, `rbac_group_id`, `user_id`. Value forms: `connector_name` matches case-insensitively, a display name such as 'GitHub MCP' also matches its normalized stored form ('github'), and for rows whose `connector_name` is an opaque connector id the connector's display name (`connector_display_name`) also matches; `product` is one of `chat_cowork_unified`, `chat`, `claude_code`, `cowork`, or `office_agent`; `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. `chat_cowork_unified` is accepted as a `product` value only on deployments that offer Chat and Cowork unified. - `groupBy?:optional list` (query parameter) Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `product`, `rbac_group_id`, `user_id`. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries. - `limit?:optional int` (query parameter) Number of results per page (1-1000, default 100). - `order?:optional Order` (query parameter) Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted. - `orderBy?:optional string` (query parameter) Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set). - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page` field. - `startingDate?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. #### Returns - `class AnalyticsConnectorActivity` - `AnalyticsConnectorChatMetrics chatMetrics` Claude.ai activity metrics for a single connector on a given day. - `AnalyticsConnectorClaudeCodeMetrics claudeCodeMetrics` Claude Code activity metrics for a single connector on a given day. - `string connectorName` Name of the connector. Some rows carry an opaque connector id here instead of a readable name; `connector_display_name` holds the resolved name for those rows. - `AnalyticsConnectorCoworkMetrics coworkMetrics` Cowork activity metrics for a single connector on a given day. - `int distinctUserCount` Number of distinct users who used the connector on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values. - `AnalyticsConnectorOfficeMetrics officeMetrics` Office Agent activity metrics for a single connector on a given day, broken out by Office product. - `?ChatCoworkUnifiedMetrics chatCoworkUnifiedMetrics` Connector use recorded while members had Chat and Cowork unified (Cowork's features inside claude.ai chat) turned on, split into chat conversations and Cowork sessions. A count is null in date-range mode where it cannot be computed. Omitted from the response on deployments that do not offer Chat and Cowork unified. - `?string connectorDisplayName` Human-readable display name for rows whose `connector_name` is an opaque connector id rather than a readable name, resolved at request time from the organization's connectors (including connectors that have since been removed). `connector_name` remains the row's stable key for sorting and pagination, and `filter[]=connector_name:{value}` also matches these rows by display name. Display names are not unique, and the same connector's claude.ai usage can appear under a separate row with a readable `connector_name`. Null when `connector_name` is already a readable name, when the id cannot be resolved to one of the organization's connectors, or when display-name resolution is not enabled for this organization. - `?int individualAuthDistinctUserCount` Number of distinct users whose use of this connector on the requested day ran on their own individual credential, connected through their own consent flow. Companion bucket to `managed_auth_distinct_user_count`, which carries the measurement, attribution, and null rules. Users whose requests used no stored credential count in neither bucket. - `?int managedAuthDistinctUserCount` Number of distinct users whose use of this connector on the requested day ran on Enterprise Managed Auth (an organization-managed credential provisioned through the organization's identity provider), read from the token record each request used. Null, never 0, when managed-auth reporting is not enabled for the organization, the value cannot be attributed to the row, no credentialed requests and no managed-token mint events (a managed credential being provisioned for a user's use of the connector) were observed that day, or the day predates 2026-07-01, the first day the backing data exists (forward-only data, no backfill). When credentialed requests or mint events were observed and attributed, both managed-auth fields populate, reporting 0 for a bucket with no users; the two counts are independent, not a partition — a user whose requests that day used both kinds of credential counts in both. Mint events carry user but not surface attribution, so they count as observed auth activity on `user_id` and `rbac_group_id` cuts — attributed to the user the credential was provisioned for — but never on a cut that references `product` (group or filter). Date-range rollup mode (`starting_date`/`ending_date`) computes both fields exactly over the window — distinct users with at least one qualifying day — when the whole window starts on or after 2026-07-01, with the null-versus-0 and mint-event rules applying with the window in place of the day; a range starting earlier reports every managed-auth field as null, never a partial-window value. - `?string product` Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, `office_agent`, or `chat_cowork_unified` (Chat and Cowork unified). These are the canonical Cost & Usage product names; an `office_agent` row's per-surface breakdown is in its `office_metrics`. On `/plugins` only `cowork`, `claude_code` and `chat_cowork_unified` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, `cowork` and `chat_cowork_unified` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`. - `?string rbacGroupID` Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`. - `?string rbacGroupName` Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key. - `?int readCallCount` Number of connector tool calls on the requested day whose trusted read-only annotation marked them read-only. Call count, not distinct users. Every call recorded on a classified surface lands in exactly one of `read_call_count`, `write_call_count`, or `unclassified_call_count`, so the three sum to the day's classified calls. Classification is forward-only per surface: claude.ai from 2026-06-01, Claude Code from 2026-05-30, Claude in Office from 2026-05-29, Cowork from 2026-06-02 (Cowork clients predating annotation forwarding land in `unclassified_call_count`). Null, never 0, when the value cannot be stated: the read/write split is not enabled for this organization, or the day predates 2026-05-29. For a date-range total, sum the per-day values, but treat a window that extends before 2026-05-29 as null rather than summing only its covered days — date-range rollup mode (`starting_date`/`ending_date`) applies both rules server-side. - `?int unclassifiedCallCount` Number of connector tool calls on the requested day with no trusted read-only annotation — the annotation is optional in the MCP spec and is discarded when connector access controls are active, so unclassified calls are common. This field shows how much of the day's classified activity the read/write split actually covers. Call count, not distinct users. One of the three call-classification buckets; see `read_call_count` for the per-surface data-start dates, null conditions, and date-range guidance. - `?string userID` Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`. - `?int writeCallCount` Number of connector tool calls on the requested day whose trusted read-only annotation marked them not read-only. Call count, not distinct users. One of the three call-classification buckets; see `read_call_count` for the per-surface data-start dates, null conditions, and date-range guidance. #### Example ```php beta->organization->analytics->connectors->list( date: '2019-12-27', endingDate: '2019-12-27', filter: ['string'], groupBy: ['product'], limit: 1, order: 'asc', orderBy: 'order_by', page: 'page', startingDate: '2019-12-27', ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "chat_metrics": { "distinct_conversation_connector_used_count": 0 }, "claude_code_metrics": { "distinct_session_connector_used_count": 0 }, "connector_name": "connector_name", "cowork_metrics": { "distinct_session_connector_used_count": 0 }, "distinct_user_count": 0, "office_metrics": { "excel": { "distinct_session_connector_used_count": 0 }, "outlook": { "distinct_session_connector_used_count": 0 }, "powerpoint": { "distinct_session_connector_used_count": 0 }, "word": { "distinct_session_connector_used_count": 0 } }, "chat_cowork_unified_metrics": { "chat": { "distinct_conversation_connector_used_count": 0 }, "sessions": { "distinct_session_connector_used_count": 0 } }, "connector_display_name": "connector_display_name", "individual_auth_distinct_user_count": 0, "managed_auth_distinct_user_count": 0, "product": "product", "rbac_group_id": "rbac_group_id", "rbac_group_name": "rbac_group_name", "read_call_count": 0, "unclassified_call_count": 0, "user_id": "user_id", "write_call_count": 0 } ], "next_page": "next_page" } ``` ## Organization › Analytics › Plugins ### Get Plugin Usage `$client->beta->organization->analytics->plugins->list(?\Datetime date, ?\Datetime endingDate, ?list filter, ?list groupBy, ?int limit, ?Order order, ?string orderBy, ?string page, ?\Datetime startingDate): PageCursor` **GET** `/v1/organizations/analytics/plugins` Get per-plugin install + invocation usage for a given day, with pagination. Returns plugin usage metrics for the organization across Cowork and Claude Code, sorted by plugin name. The `plugin_name` value `third-party` is an aggregate bucket, not a plugin: it collects plugin activity, from either surface, for which the reporting client did not provide a plugin name — so an organization's own plugins can contribute both to their own named rows and to this bucket. Use `group_by[]` to break usage out per member, per RBAC group, or per product surface (Cowork / Claude Code), and `filter[]` to scope results; the parameter descriptions list the supported dimensions. Requires an API key with the `read:analytics` scope. `starting_date` / `ending_date` select range-rollup mode like `/skills`. #### Parameters - `date?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. The day to get plugin usage for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. - `endingDate?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`. - `filter?:optional list` (query parameter) Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `plugin_name`, `product`, `rbac_group_id`, `user_id`. Value forms: `plugin_name` matches case-insensitively; `product` is `chat_cowork_unified`, `claude_code`, or `cowork` (the only surfaces with plugin attribution); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. `chat_cowork_unified` is accepted as a `product` value only on deployments that offer Chat and Cowork unified. - `groupBy?:optional list` (query parameter) Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `product`, `rbac_group_id`, `user_id`. On this endpoint `product` takes the values `chat_cowork_unified`, `claude_code`, or `cowork` only (the surfaces with plugin attribution). Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries. - `limit?:optional int` (query parameter) Number of results per page (1-1000, default 100). - `order?:optional Order` (query parameter) Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted. - `orderBy?:optional string` (query parameter) Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set). - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page` field. - `startingDate?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. #### Returns - `class AnalyticsPluginActivity` - `AnalyticsPluginClaudeCodeMetrics claudeCodeMetrics` Claude Code activity metrics for a single plugin on a given day. - `AnalyticsPluginCoworkMetrics coworkMetrics` Cowork activity metrics for a single plugin on a given day. - `int distinctUserCount` Number of distinct users with recorded install or invocation activity for the plugin on the requested day (install-only users count), or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values. - `?int installCount` Number of distinct users who installed the plugin on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values. - `int invocationCount` Number of plugin invocations on the requested day - `string pluginName` Name of the plugin - `?ChatCoworkUnifiedMetrics chatCoworkUnifiedMetrics` Plugin use recorded while members had Chat and Cowork unified (Cowork's features inside claude.ai chat) turned on. A count is null in date-range mode where it cannot be computed. Omitted from the response on deployments that do not offer Chat and Cowork unified. - `?string pluginID` Stable plugin identifier when available (e.g. `serena@claude-plugins-official`). Null for third-party Claude Code plugins (redacted at the source) and Cowork slash commands that carry only a hashed id. - `?string product` Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, `office_agent`, or `chat_cowork_unified` (Chat and Cowork unified). These are the canonical Cost & Usage product names; an `office_agent` row's per-surface breakdown is in its `office_metrics`. On `/plugins` only `cowork`, `claude_code` and `chat_cowork_unified` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, `cowork` and `chat_cowork_unified` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`. - `?string rbacGroupID` Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`. - `?string rbacGroupName` Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key. - `?string userID` Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`. #### Example ```php beta->organization->analytics->plugins->list( date: '2019-12-27', endingDate: '2019-12-27', filter: ['string'], groupBy: ['product'], limit: 1, order: 'asc', orderBy: 'order_by', page: 'page', startingDate: '2019-12-27', ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "claude_code_metrics": { "distinct_session_plugin_used_count": 0 }, "cowork_metrics": { "distinct_session_plugin_used_count": 0 }, "distinct_user_count": 0, "install_count": 0, "invocation_count": 0, "plugin_name": "plugin_name", "chat_cowork_unified_metrics": { "distinct_session_plugin_used_count": 0 }, "plugin_id": "plugin_id", "product": "product", "rbac_group_id": "rbac_group_id", "rbac_group_name": "rbac_group_name", "user_id": "user_id" } ], "next_page": "next_page" } ``` ## Organization › Analytics › Skills ### Get Skill Usage `$client->beta->organization->analytics->skills->list(?\Datetime date, ?\Datetime endingDate, ?list filter, ?list groupBy, ?int limit, ?Order order, ?string orderBy, ?string page, ?\Datetime startingDate): PageCursor` **GET** `/v1/organizations/analytics/skills` Get per-skill usage for a given day, with cursor-based pagination. Returns skill usage metrics for the organization, sorted by skill name. Use `group_by[]` to break usage out per member, per RBAC group, or per product surface, and `filter[]` to scope results; the parameter descriptions list the supported dimensions. Available to organizations on a Claude Enterprise plan. Requires an API key with the `read:analytics` scope. #### Parameters - `date?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. The day to get skill usage for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. - `endingDate?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. End of the date range (exclusive); only valid with `starting_date`. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day), so this can be at most today — which is also the default when omitted, resolved once when the first page is served and reused for the rest of the pagination sequence. At most 366 days after `starting_date`. - `filter?:optional list` (query parameter) Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `product`, `rbac_group_id`, `share_status`, `skill_name`, `user_id`. Value forms: `product` is one of `chat_cowork_unified`, `chat`, `claude_code`, `cowork`, or `office_agent`; `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `share_status` is one of `organization`, `private`, or `public`; `skill_name` matches case-insensitively; `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. `chat_cowork_unified` is accepted as a `product` value only on deployments that offer Chat and Cowork unified. - `groupBy?:optional list` (query parameter) Dimensions to break results out by (e.g. `group_by[]=user_id`). Supported on this endpoint: `product`, `rbac_group_id`, `user_id`. Grouped rows carry the requested dimension values as additional fields and paginate like ungrouped responses via `next_page`; an unsupported dimension returns 400. `rbac_group_id` attributes a user to every group they held at any point during each covered UTC day, so grouped rows are not an exclusive partition and can sum above org-level totals. At most 100 entries. - `limit?:optional int` (query parameter) Number of results per page (1-1000, default 100). - `order?:optional Order` (query parameter) Sort direction: `asc` or `desc`. Defaults to `asc` for the endpoint's sort column and to `desc` when `order_by` names a metric (a top-N ranking). Applies to `order_by`, or to the endpoint's default sort field when `order_by` is omitted. - `orderBy?:optional string` (query parameter) Sort field. Restricted to the endpoint's sort column plus its rankable metrics (metrics default to descending; a few metrics rank in date-range mode only, per the endpoint's documented orderable set). - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page` field. - `startingDate?:optional \Datetime` (query parameter) UTC date in YYYY-MM-DD format. Start of a date range (inclusive). Enables rollup mode: one row per entity aggregated over the whole range — addable counters are summed across days, and a distinct count is never summed where summing could double-count (a field's range value is recomputed exactly over the window, approximate via HLL with typical error under 2%, null, or — for the creation-event counts, whose per-day values cannot overlap — a per-day sum that is itself exact; each field's own description says which). Use either `date` or `starting_date`, not both. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. #### Returns - `class AnalyticsSkillActivity` - `AnalyticsSkillChatMetrics chatMetrics` Claude.ai activity metrics for a single skill on a given day. - `AnalyticsSkillClaudeCodeMetrics claudeCodeMetrics` Claude Code activity metrics for a single skill on a given day. - `AnalyticsSkillCoworkMetrics coworkMetrics` Cowork activity metrics for a single skill on a given day. - `int distinctUserCount` Number of distinct users who used the skill on the requested day, or, in date-range mode, over the requested window — recomputed as an exact distinct count over the window's per-member daily rows, never a sum of per-day values. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted. - `AnalyticsSkillOfficeMetrics officeMetrics` Office Agent activity metrics for a single skill on a given day, broken out by Office product. - `string skillName` Name of the skill - `?string attributedListPrice` List-price (rate-card) value of the member requests attributed to this skill, as a decimal string in the minor unit of `currency` (cents for USD), from Claude Code, Cowork, and Office Agent request-level attribution — the value of requests that involved the skill, not the skill's incremental cost. Unlike `estimated_overage_spend` this reflects usage value regardless of how it was funded — seat-covered usage counts — but it is undiscounted and does not tie to billed spend or the organization's spend reporting. claude.ai chat usage carries no request-level attribution and contributes nothing: the field is null on `chat` product rows and on `office_agent` product cuts dated before 2026-06-18 (the Office Agent attribution data-start), and on ungrouped rows it covers the Claude Code + Cowork + Office Agent share only (null when no attributable usage exists). Also null under the same conditions as `estimated_overage_spend` (spend reporting not enabled for this organization, `office_agent` product cuts before the 2026-06-18 data-start). "0" means attributable usage existed but none was attributed to this skill. Addable across days: date-range rollup mode returns the window's sum. On `group_by[]` and `filter[]` shapes both amounts can total below the ungrouped value for the same skill over the same date or range: spend attributed to a member–skill pair with no counted usage on that day is excluded from those cuts. - `?ChatCoworkUnifiedMetrics chatCoworkUnifiedMetrics` Skill use recorded while members had Chat and Cowork unified (Cowork's features inside claude.ai chat) turned on, split into chat conversations and Cowork sessions. A count is null in date-range mode where it cannot be computed. Omitted from the response on deployments that do not offer Chat and Cowork unified. - `?string currency` Currency for this row's monetary fields (`estimated_overage_spend` and `attributed_list_price`), as an uppercase ISO-4217 code. Always "USD" when either amount is populated; null whenever both amounts are null. - `?int enableCount` Distinct accounts that enabled this skill on the requested day (claude.ai only — the skill analog of plugin `install_count`). The count is org-wide: null when enable reporting is not enabled for this organization, or when the request scopes to `user_id` / `rbac_group_id` / `product` via `group_by[]` or `filter[]` (an org-wide count would be misleading on per-cut rows). A distinct count, not an event count: summing across days double-counts members who enable the skill on more than one day, so it is also null in date-range rollup mode (`starting_date`/`ending_date`). - `?string estimatedOverageSpend` Estimated overage spend attributed to this skill, as a decimal string in the minor unit of `currency` (cents for USD; "1250" is $12.50, fractional cents possible) — an allocation of each member's daily post-discount, pre-credit metered overage spend (the same cost basis as the organization's spend reporting and the Cost & Usage API, so per-skill figures are directly comparable; spend with no skill attribution — including any member-day without skill invocations — is not represented, so skill rows sum to at most those totals) across the skills the member used. Overage only: usage covered by included seat allowances bills nothing and allocates $0 here — see `attributed_list_price` for the funding-independent usage-value companion. Claude Code, Cowork, and Office Agent spend use request-level skill attribution; claude.ai chat spend is approximated proportionally to skill-invoking messages. An estimate, not a billing number — and the cost of the requests/messages that involved the skill, not the skill's incremental cost (the same request would still have cost something without the skill active). "0" means no overage spend was attributed; null when spend reporting is not enabled for this organization, on `office_agent` product cuts dated before 2026-06-18 (the Office Agent attribution data-start). Addable across days: date-range rollup mode (`starting_date`/`ending_date`) returns the window's sum. With `group_by[]=user_id` each row carries the user's own attributed spend. On `group_by[]` and `filter[]` shapes both amounts can total below the ungrouped value for the same skill over the same date or range: spend attributed to a member–skill pair with no counted usage on that day is excluded from those cuts. - `?int invocationCount` Total number of times this skill was invoked on the requested day (the skill analog of plugin `invocation_count`). Unlike `distinct_user_count` — which answers '\# of users' — this is the true '# of uses'. A skill counts as used only when it is explicitly activated — the model (or the user, via the skill's slash command) invokes it, reading its instructions into context as part of that activation. Skills that are merely installed or listed as available, or whose content reaches the context without an activation (preloaded, hook-injected, or read as a plain file), are not counted. Null when invocation reporting is not enabled for this organization. Sum across a date range for total uses in the window — date-range rollup mode (`starting_date`/`ending_date`) returns this sum directly. - `?string product` Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, `office_agent`, or `chat_cowork_unified` (Chat and Cowork unified). These are the canonical Cost & Usage product names; an `office_agent` row's per-surface breakdown is in its `office_metrics`. On `/plugins` only `cowork`, `claude_code` and `chat_cowork_unified` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, `cowork` and `chat_cowork_unified` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`. - `?string rbacGroupID` Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`. - `?string rbacGroupName` Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key. - `?ShareStatus shareStatus` Skill share status (claude.ai only): one of `private`, `organization`, or `public`. Null for skills used only in Claude Code or Office (no per-skill share-status concept) and when share-status reporting is not yet available for the organization. Filterable via `filter[]=share_status:{value}`. - `?string skillDisplayName` Human-readable display name for rows whose `skill_name` is an opaque skill id (user/organization skill types and plugin-delivered skills, whose user-defined names usage reports generally withhold). Organization-shared skills and skills delivered by the organization's own plugins (its plugin marketplaces and its library) resolve; plugin skill names are shown without their 'plugin:' prefix. The literal 'unknown' bucket row gets a fixed 'Unknown skill' label. For a member's own skill (private or personal-plugin) it is null, except when the skill's owner used it from Claude Code or Cowork in the requested period: then it shows the name that client reported at the time. Apart from that, the names of members' own skills are not disclosed to analytics-key holders. Also null for Anthropic-provided plugin skills (not resolved), for an organization skill or plugin whose name can no longer be found (for example, one since deleted), when `skill_name` is already a display name, or when display-name resolution is not enabled for this organization. - `?string userID` Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`. #### Example ```php beta->organization->analytics->skills->list( date: '2019-12-27', endingDate: '2019-12-27', filter: ['string'], groupBy: ['product'], limit: 1, order: 'asc', orderBy: 'order_by', page: 'page', startingDate: '2019-12-27', ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "chat_metrics": { "distinct_conversation_skill_used_count": 0 }, "claude_code_metrics": { "distinct_session_skill_used_count": 0 }, "cowork_metrics": { "distinct_session_skill_used_count": 0 }, "distinct_user_count": 0, "office_metrics": { "excel": { "distinct_session_skill_used_count": 0 }, "outlook": { "distinct_session_skill_used_count": 0 }, "powerpoint": { "distinct_session_skill_used_count": 0 }, "word": { "distinct_session_skill_used_count": 0 } }, "skill_name": "skill_name", "attributed_list_price": "attributed_list_price", "chat_cowork_unified_metrics": { "chat": { "distinct_conversation_skill_used_count": 0 }, "sessions": { "distinct_session_skill_used_count": 0 } }, "currency": "currency", "enable_count": 0, "estimated_overage_spend": "estimated_overage_spend", "invocation_count": 0, "product": "product", "rbac_group_id": "rbac_group_id", "rbac_group_name": "rbac_group_name", "share_status": "organization", "skill_display_name": "skill_display_name", "user_id": "user_id" } ], "next_page": "next_page" } ``` ## Organization › Analytics › Artifacts ### Get Artifact Activity `$client->beta->organization->analytics->artifacts->list(\Datetime date, ?list filter, ?list groupBy, ?int limit, ?string page): PageCursor` **GET** `/v1/organizations/analytics/artifacts` Get artifact-creation activity for a given day, broken out by MIME type. Returns the full (`artifact_type`, `is_shared`) cube for the organization; `next_page` is null except for grouped queries, which paginate. The cube can be broken out per product, per member, or per RBAC group via `group_by[]`, and scoped via `filter[]`. Requires an API key with the `read:analytics` scope. #### Parameters - `date: \Datetime` (query parameter) UTC date in YYYY-MM-DD format. The day to get artifact activity for. Data is typically available with a 1-day lag (varies by query; the error for a too-recent date names the latest available day) and may be revised by a few percent over the following days. No earlier than 2026-01-01. - `filter?:optional list` (query parameter) Filters as `dimension:value`, e.g. `filter[]=rbac_group_id:{id}`. Repeat the param for OR within a dimension and across dimensions for AND. Supported dimensions on this endpoint: `artifact_type`, `is_shared`, `product`, `rbac_group_id`, `user_id`. Value forms: `artifact_type` is a canonical artifact MIME type (e.g. `text/markdown`) or `other`; `is_shared` is `true` or `false`; `product` is `chat_cowork_unified`, `chat`, `claude_code`, or `cowork` (the surfaces that create artifacts); `rbac_group_id` takes the tagged id (`rbac_group_...`, as emitted in responses and by the spend-limits API) or a bare group UUID, and matches users who held the group at any point during each covered UTC day (time-of-usage attribution); `user_id` takes a tagged user id (`user_...`), as emitted in responses. An unsupported dimension returns 400. At most 100 entries. `chat_cowork_unified` is accepted as a `product` value only on deployments that offer Chat and Cowork unified. - `groupBy?:optional list` (query parameter) Dimensions to break results out by: `product`, `user_id` and/or `rbac_group_id`. The ungrouped artifact-type cube is finite and returned in full; grouped queries multiply the cube and paginate via `next_page`. `product` takes the values `chat_cowork_unified`, `chat`, `claude_code`, or `cowork` (the surfaces that create artifacts). `rbac_group_id` attributes a user to every group they held at any point during the requested UTC day, so grouped rows are not an exclusive partition. At most 100 entries. - `limit?:optional int` (query parameter) Maximum rows to return (1-1000, default 100). The ungrouped artifact-type cube is finite and returned in full; `limit` is the page size only when `group_by[]` multiplies the cube. - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page` field. Only valid with `group_by[]` — the ungrouped cube is never paginated. #### Returns - `class AnalyticsArtifactActivity` - `string artifactType` Canonical artifact MIME type (e.g. `text/markdown`, `application/vnd.ant.react`, `image/svg+xml`), or `other`. Claude Code and Cowork artifacts report as `text/html`. - `int artifactsCreatedCount` Number of artifacts created in this bucket on the requested day - `int distinctUserCount` Number of distinct users who created artifacts in this bucket on the requested day - `bool isShared` Whether the artifacts in this bucket have ever been shared (a Claude Code / Cowork artifact is shared once anyone beyond its creator may open it: named members, the whole organization, or anyone with the link). - `int publishedArtifactsCreatedCount` Number of those artifacts that have been published (for Claude Code / Cowork artifacts: open to anyone with the link); never exceeds `artifacts_created_count` - `?string product` Product that produced this row's activity: one of `chat`, `claude_code`, `cowork`, `office_agent`, or `chat_cowork_unified` (Chat and Cowork unified). These are the canonical Cost & Usage product names; an `office_agent` row's per-surface breakdown is in its `office_metrics`. On `/plugins` only `cowork`, `claude_code` and `chat_cowork_unified` occur (the only surfaces with plugin attribution); on `/artifacts` only `chat`, `claude_code`, `cowork` and `chat_cowork_unified` occur (the surfaces that create artifacts); `/apps/chat/projects` does not support the product dimension (a `product` entry in `group_by[]` or `filter[]` there is rejected). Present only when the request grouped by `product`. - `?string rbacGroupID` Tagged RBAC group identifier (`rbac_group_...`), matching the spend-limits API spelling. Present only when the request grouped by `rbac_group_id`. - `?string rbacGroupName` Resolved RBAC group display name, alongside `rbac_group_id` when name resolution is available. Null if the group has been deleted or its name could not be resolved; `rbac_group_id` remains the stable key. - `?string userID` Tagged user identifier (e.g. `user_...`). Present only when the request grouped by `user_id`. #### Example ```php beta->organization->analytics->artifacts->list( date: '2019-12-27', filter: ['string'], groupBy: ['product'], limit: 1, page: 'page', ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "artifact_type": "artifact_type", "artifacts_created_count": 0, "distinct_user_count": 0, "is_shared": true, "published_artifacts_created_count": 0, "product": "product", "rbac_group_id": "rbac_group_id", "rbac_group_name": "rbac_group_name", "user_id": "user_id" } ], "next_page": "next_page" } ``` ## Organization › Analytics › Usage Report ### Get Token Usage Over Time `$client->beta->organization->analytics->usageReport->list(\Datetime startingAt, ?BucketWidth bucketWidth, ?list claudeTagCategories, ?list claudeTagUserIDs, ?list contextWindows, ?\Datetime endingAt, ?list groupBy, ?list inferenceGeos, ?int limit, ?list models, ?string page, ?list products, ?list rbacGroupIDs, ?list slackChannelIDs, ?list speeds, ?list userIDs): ReportPageCursor` **GET** `/v1/organizations/analytics/usage_report` Get token usage over time across a date range. Returns token usage bucketed by minute, hour, or day, optionally broken down by product, model, context window, inference region, or speed. Available to organizations on a Claude Enterprise plan. Requires an API key with the `read:analytics` scope. #### Parameters - `startingAt: \Datetime` (query parameter) Start of range, inclusive. RFC 3339 tz-aware. Must be within the last 365 days and no earlier than 2026-01-01T00:00:00Z. - `bucketWidth?:optional BucketWidth` (query parameter) Time bucket granularity. default: 1d - `claudeTagCategories?:optional list` (query parameter) Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values. - `claudeTagUserIDs?:optional list` (query parameter) Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values. - `contextWindows?:optional list` (query parameter) Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values. - `endingAt?:optional \Datetime` (query parameter) End of range, exclusive. When omitted, defaults to the earlier of now and `starting_at` + 31 days. The range may span at most 31 days. - `groupBy?:optional list` (query parameter) Dimensions to break each time bucket out by. Defaults to no grouping (one total per bucket). Each bucket reports at most its top 100 groups; a group beyond that cap has no row in that bucket (there is no remainder row), so grouped buckets are not exhaustive when a dimension has more than 100 distinct values. - `inferenceGeos?:optional list` (query parameter) Filter to specific inference regions. `not_available` matches rows where the region is unset. Use `group_by[]=inference_geo` to break out per-region values. - `limit?:optional int` (query parameter) Maximum number of time buckets per page. Defaults and caps vary by `bucket_width` (`1d`: default 7, max 31; `1h`: default 24, max 168; `1m`: default 60, max 256). - `models?:optional list` (query parameter) Models to include. Defaults to all models. Use `group_by[]=model` to break out per-model values. - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page` field. - `products?:optional list` (query parameter) Product surfaces to include. Defaults to all products. Use `group_by[]=product` to break out per-product values. - `rbacGroupIDs?:optional list` (query parameter) Filter to usage attributed to specific RBAC groups. Accepts tagged RBAC group IDs (`rbac_group_...`) or bare group UUIDs. A row matches when the user belonged to any of the listed groups on the (UTC) day the usage occurred; usage with no group attribution never matches. - `slackChannelIDs?:optional list` (query parameter) Filter to usage originating from specific Slack channels. Use `group_by[]=slack_channel_id` to break out per-channel values. - `speeds?:optional list` (query parameter) Filter to fast or standard inference mode. Use `group_by[]=speed` to break out per-mode values. - `userIDs?:optional list` (query parameter) Filter to specific users by tagged user ID. #### Returns - `class AnalyticsUsageReportTimeBucket` - `\Datetime endingAt` End of the time bucket (exclusive) in RFC 3339 format. - `list results` Rows for this time bucket. Empty when the bucket has no data; otherwise a single combined row when `group_by[]` is omitted, or one row per group (subject to the per-bucket group cap described on the `group_by[]` parameter). - `\Datetime startingAt` Start of the time bucket (inclusive) in RFC 3339 format. #### Example ```php beta->organization->analytics->usageReport->list( startingAt: new \DateTimeImmutable('2019-12-27T18:11:19.117Z'), bucketWidth: '1d', claudeTagCategories: [AnalyticsClaudeTagCategory::ENGAGED], claudeTagUserIDs: ['U0123ABCDEF'], contextWindows: [AnalyticsContextWindow::FROM_0_TO_200K], endingAt: new \DateTimeImmutable('2019-12-27T18:11:19.117Z'), groupBy: ['claude_tag_category'], inferenceGeos: [AnalyticsInferenceGeoFilter::GLOBAL], limit: 1, models: ['string'], page: 'page', products: [AnalyticsProductFilter::CHAT], rbacGroupIDs: ['rbac_group_012rppKaSVsmTo6NqRDXQXNF'], slackChannelIDs: ['C0123ABCDEF'], speeds: ['fast'], userIDs: ['string'], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "ending_at": "2019-12-27T18:11:19.117Z", "results": [ { "cache_creation": { "ephemeral_1h_input_tokens": 0, "ephemeral_5m_input_tokens": 0 }, "cache_read_input_tokens": 0, "claude_tag_category": "dm", "claude_tag_user_id": "U0123ABCDEF", "context_window": "0-200k", "inference_geo": "global", "model": "claude-opus-5-5", "output_tokens": 0, "product": "chat", "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "requests": 0, "server_tool_use": { "web_search_requests": 10 }, "slack_channel_id": "C0123ABCDEF", "speed": "fast", "uncached_input_tokens": 0 } ], "starting_at": "2019-12-27T18:11:19.117Z" } ], "data_refreshed_at": "2019-12-27T18:11:19.117Z", "has_more": true, "next_page": "next_page", "organization_id": "org_013FP9SaFPBg7Kw7fetjn6cF" } ``` ## Organization › Analytics › User Usage Report ### Get Per-User Token Usage `$client->beta->organization->analytics->userUsageReport->list(\Datetime startingAt, ?BucketWidth bucketWidth, ?list claudeTagCategories, ?list claudeTagUserIDs, ?list contextWindows, ?\Datetime endingAt, ?bool excludeDeletedUsers, ?list groupBy, ?list inferenceGeos, ?int limit, ?list models, ?Order order, ?OrderBy orderBy, ?string page, ?list products, ?list rbacGroupIDs, ?list slackChannelIDs, ?list speeds, ?list userIDs): ReportPageCursor` **GET** `/v1/organizations/analytics/user_usage_report` Get per-user token usage across a date range. Returns one row per user, ranked by the chosen token metric. Use this to see which users consume the most tokens. Only usage attributable to a seat user is included; for organization-wide totals including direct API-key and automation traffic, use the bucketed `/v1/organizations/analytics/usage_report` endpoint. Available to organizations on a Claude Enterprise plan. Requires an API key with the `read:analytics` scope. #### Parameters - `startingAt: \Datetime` (query parameter) Start of range, inclusive. RFC 3339 tz-aware. Must be within the last 365 days and no earlier than 2026-01-01T00:00:00Z. - `bucketWidth?:optional BucketWidth` (query parameter) Time-bucket granularity. When set, each row's `starting_at` and `ending_at` are populated and one actor may span several rows (one per time bucket with usage). The time bucket counts toward `limit`, so one page can return multiple rows for the same actor. `ending_at` is required when `bucket_width` is set, and with `bucket_width="1m"` the range may span at most 24 hours. When omitted, each row aggregates the full `[starting_at, ending_at)` range. - `claudeTagCategories?:optional list` (query parameter) Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values. - `claudeTagUserIDs?:optional list` (query parameter) Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values. - `contextWindows?:optional list` (query parameter) Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values. - `endingAt?:optional \Datetime` (query parameter) End of range, exclusive. When omitted, defaults to the earlier of now and `starting_at` + 31 days. The range may span at most 31 days. - `excludeDeletedUsers?:optional bool` (query parameter) If true, omit rows for users who are deleted (`deleted: true`). A page may contain fewer than `limit` rows; use `has_more` and `next_page` to paginate as usual. default: false - `groupBy?:optional list` (query parameter) Break each actor's row out by the given dimensions. Accepts the same values as the bucketed `/usage_report` endpoint. `limit` bounds (actor × time bucket × dimension) rows — with dimensions or `bucket_width` present, one actor may span several rows. - `inferenceGeos?:optional list` (query parameter) Filter to specific inference regions. `not_available` matches rows where the region is unset. Use `group_by[]=inference_geo` to break out per-region values. - `limit?:optional int` (query parameter) Number of rows per page (1-1000, default 20). One row per actor unless `group_by[]` or `bucket_width` splits an actor across rows; `cost_type`/`token_type` fan-out rows (cost endpoint only) are the exception — they do not count toward this limit, so `data` can exceed it. default: 20 - `models?:optional list` (query parameter) Models to include. Defaults to all models. Use `group_by[]=model` to break out per-model values. - `order?:optional Order` (query parameter) Sort direction. Defaults to `desc`. default: desc - `orderBy?:optional OrderBy` (query parameter) Metric to rank actors by. Defaults to `total_tokens`. default: total_tokens - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page` field. - `products?:optional list` (query parameter) Product surfaces to include. Defaults to all products. - `rbacGroupIDs?:optional list` (query parameter) Filter to usage attributed to specific RBAC groups. Accepts tagged RBAC group IDs (`rbac_group_...`) or bare group UUIDs. A row matches when the user belonged to any of the listed groups on the (UTC) day the usage occurred; usage with no group attribution never matches. - `slackChannelIDs?:optional list` (query parameter) Filter to usage originating from specific Slack channels. Use `group_by[]=slack_channel_id` to break out per-channel values. - `speeds?:optional list` (query parameter) Filter to fast or standard inference mode. Use `group_by[]=speed` to break out per-mode values. - `userIDs?:optional list` (query parameter) Filter to specific users by tagged user ID. #### Returns - `class AnalyticsUsageUsersItem` - `AnalyticsUserActor actor` The user this row's usage or cost is attributed to. Always a `user_actor`. - `BetaCacheCreation cacheCreation` The number of input tokens for cache creation. - `int cacheReadInputTokens` The number of input tokens read from the cache. - `?AnalyticsClaudeTagCategory claudeTagCategory` Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time. - `?string claudeTagUserID` Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter. - `?AnalyticsContextWindow contextWindow` Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution. - `?\Datetime endingAt` End of the row's UTC time bucket (exclusive), as an RFC 3339 timestamp; equal to `starting_at` plus one `bucket_width`. Null unless `bucket_width` is set. - `?InferenceGeo inferenceGeo` Inference region of the usage or cost. Null unless `inference_geo` is in `group_by[]`; it can also be null on grouped rows where the region is not set (the rows that `inference_geos[]=not_available` matches). - `?string model` Model that produced the usage or cost, as a model name in the form the `models[]` filter accepts (for example, `claude-opus-5-5`). Null unless `model` is in `group_by[]`; it can also be null on grouped rows whose usage or cost is not attributed to a specific model, such as code execution. - `int outputTokens` The number of output tokens generated. - `?string product` Product surface that produced the usage or cost. Null unless product is in `group_by[]`; it can also be null on grouped rows whose usage cannot be attributed to a known surface. Values include `chat`, `claude_code`, `cowork`, `office_agent`, `claude_in_chrome`, `claude_design`, `claude-tag`, and `chat_cowork_unified`. `claude-tag` is Claude Tag, the Claude product in Slack. `chat_cowork_unified` is Chat and Cowork unified, Cowork's features inside claude.ai chat: chat and Cowork usage by a member who has it turned on is reported under this value instead of `chat` or `cowork`. It is accepted as a filter only on deployments that offer Chat and Cowork unified. Some unattributed usage is reported as "other". - `?string rbacGroupID` RBAC group (team) the usage is attributed to, in the public tagged `rbac_group_...` spelling — the same spelling the activity resources use for this key, so the same team has one id across resources and it round-trips as an `rbac_group_ids[]` filter value. Populated only when `rbac_group_id` is in `group_by[]`. Any-membership semantics: a user in several groups contributes their full usage to each of those groups' rows, so the named-group rows overlap and their sum can exceed the org total. A null value is the single unassigned row: users in no group on that (UTC) day. For the true org total, run the same query without `group_by[]`. - `?int requests` Number of API requests in this row's scope. For sandbox / code-execution events, this counts execution spans rather than HTTP requests (these rows surface with `product: null`). - `AnalyticsServerToolUse serverToolUse` Server-side tool usage metrics. - `?string slackChannelID` Slack channel the usage originated from. Populated only when `slack_channel_id` is in `group_by[]`; null for usage outside Slack (and for rows recorded before channel attribution was enabled). - `?Speed speed` Inference speed mode of the usage or cost: `fast` or `standard`. Null unless `speed` is in `group_by[]`. - `?\Datetime startingAt` Start of the row's UTC time bucket (inclusive), as an RFC 3339 timestamp. Null unless `bucket_width` is set; without `bucket_width`, each row aggregates the full requested range. - `int totalTokens` Total token count across all token types. This is the value the default `order_by` (`total_tokens`) sorts on. - `int uncachedInputTokens` The number of uncached input tokens processed. #### Example ```php beta->organization->analytics->userUsageReport->list( startingAt: new \DateTimeImmutable('2019-12-27T18:11:19.117Z'), bucketWidth: '1d', claudeTagCategories: [AnalyticsClaudeTagCategory::ENGAGED], claudeTagUserIDs: ['U0123ABCDEF'], contextWindows: [AnalyticsContextWindow::FROM_0_TO_200K], endingAt: new \DateTimeImmutable('2019-12-27T18:11:19.117Z'), excludeDeletedUsers: true, groupBy: ['claude_tag_category'], inferenceGeos: [AnalyticsInferenceGeoFilter::GLOBAL], limit: 1, models: ['string'], order: 'asc', orderBy: 'output_tokens', page: 'page', products: [AnalyticsProductFilter::CHAT], rbacGroupIDs: ['rbac_group_012rppKaSVsmTo6NqRDXQXNF'], slackChannelIDs: ['C0123ABCDEF'], speeds: ['fast'], userIDs: ['user_01AbCdEfGhIjKlMnOpQrSt'], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "actor": { "deleted": true, "email_address": "jane@example.com", "name": "Jane Smith", "type": "user_actor", "user_id": "user_01AbCdEfGhIjKlMnOpQrSt" }, "cache_creation": { "ephemeral_1h_input_tokens": 0, "ephemeral_5m_input_tokens": 0 }, "cache_read_input_tokens": 3200000, "claude_tag_category": "dm", "claude_tag_user_id": "U0123ABCDEF", "context_window": "0-200k", "ending_at": "2019-12-27T18:11:19.117Z", "inference_geo": "global", "model": "claude-opus-5-5", "output_tokens": 891000, "product": "chat", "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "requests": 128, "server_tool_use": { "web_search_requests": 10 }, "slack_channel_id": "C0123ABCDEF", "speed": "fast", "starting_at": "2019-12-27T18:11:19.117Z", "total_tokens": 5377000, "uncached_input_tokens": 1284500 } ], "data_refreshed_at": "2019-12-27T18:11:19.117Z", "has_more": true, "next_page": "next_page", "organization_id": "org_013FP9SaFPBg7Kw7fetjn6cF" } ``` ## Organization › Analytics › Cost Report ### Get Cost Over Time `$client->beta->organization->analytics->costReport->list(\Datetime startingAt, ?BucketWidth bucketWidth, ?list claudeTagCategories, ?list claudeTagUserIDs, ?list contextWindows, ?\Datetime endingAt, ?list groupBy, ?list inferenceGeos, ?int limit, ?list models, ?string page, ?list products, ?list rbacGroupIDs, ?list slackChannelIDs, ?list speeds, ?list userIDs): ReportPageCursor` **GET** `/v1/organizations/analytics/cost_report` Get cost in USD over time across a date range. Returns cost bucketed by minute, hour, or day, optionally broken down by product, model, context window, inference region, speed, cost type, or token type. Available to organizations on a Claude Enterprise plan. Requires an API key with the `read:analytics` scope. #### Parameters - `startingAt: \Datetime` (query parameter) Start of range, inclusive. RFC 3339 tz-aware. Must be within the last 365 days and no earlier than 2026-01-01T00:00:00Z. - `bucketWidth?:optional BucketWidth` (query parameter) Time bucket granularity. default: 1d - `claudeTagCategories?:optional list` (query parameter) Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values. - `claudeTagUserIDs?:optional list` (query parameter) Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values. - `contextWindows?:optional list` (query parameter) Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values. - `endingAt?:optional \Datetime` (query parameter) End of range, exclusive. When omitted, defaults to the earlier of now and `starting_at` + 31 days. The range may span at most 31 days. - `groupBy?:optional list` (query parameter) Dimensions to break each time bucket out by. Defaults to no grouping (one total per bucket). Each bucket reports at most its top 100 groups; a group beyond that cap has no row in that bucket (there is no remainder row), so grouped buckets are not exhaustive when a dimension has more than 100 distinct values. - `inferenceGeos?:optional list` (query parameter) Filter to specific inference regions. `not_available` matches rows where the region is unset. Use `group_by[]=inference_geo` to break out per-region values. - `limit?:optional int` (query parameter) Maximum number of time buckets per page. Defaults and caps vary by `bucket_width` (`1d`: default 7, max 31; `1h`: default 24, max 168; `1m`: default 60, max 256). - `models?:optional list` (query parameter) Models to include. Defaults to all models. Use `group_by[]=model` to break out per-model values. - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page` field. - `products?:optional list` (query parameter) Product surfaces to include. Defaults to all products. Use `group_by[]=product` to break out per-product values. - `rbacGroupIDs?:optional list` (query parameter) Filter to usage attributed to specific RBAC groups. Accepts tagged RBAC group IDs (`rbac_group_...`) or bare group UUIDs. A row matches when the user belonged to any of the listed groups on the (UTC) day the usage occurred; usage with no group attribution never matches. - `slackChannelIDs?:optional list` (query parameter) Filter to usage originating from specific Slack channels. Use `group_by[]=slack_channel_id` to break out per-channel values. - `speeds?:optional list` (query parameter) Filter to fast or standard inference mode. Use `group_by[]=speed` to break out per-mode values. - `userIDs?:optional list` (query parameter) Filter to specific users by tagged user ID. #### Returns - `class AnalyticsCostReportTimeBucket` - `\Datetime endingAt` End of the time bucket (exclusive) in RFC 3339 format. - `list results` Rows for this time bucket. Empty when the bucket has no data; otherwise a single combined row when `group_by[]` is omitted, or one row per group (subject to the per-bucket group cap described on the `group_by[]` parameter). - `\Datetime startingAt` Start of the time bucket (inclusive) in RFC 3339 format. #### Example ```php beta->organization->analytics->costReport->list( startingAt: new \DateTimeImmutable('2019-12-27T18:11:19.117Z'), bucketWidth: '1d', claudeTagCategories: [AnalyticsClaudeTagCategory::ENGAGED], claudeTagUserIDs: ['U0123ABCDEF'], contextWindows: [AnalyticsContextWindow::FROM_0_TO_200K], endingAt: new \DateTimeImmutable('2019-12-27T18:11:19.117Z'), groupBy: ['claude_tag_category'], inferenceGeos: [AnalyticsInferenceGeoFilter::GLOBAL], limit: 1, models: ['string'], page: 'page', products: [AnalyticsProductFilter::CHAT], rbacGroupIDs: ['rbac_group_012rppKaSVsmTo6NqRDXQXNF'], slackChannelIDs: ['C0123ABCDEF'], speeds: ['fast'], userIDs: ['string'], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "ending_at": "2019-12-27T18:11:19.117Z", "results": [ { "amount": "amount", "claude_tag_category": "dm", "claude_tag_user_id": "U0123ABCDEF", "context_window": "0-200k", "cost_type": "code_execution", "currency": "USD", "inference_geo": "global", "list_amount": "list_amount", "model": "claude-opus-5-5", "product": "chat", "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "requests": 0, "slack_channel_id": "C0123ABCDEF", "speed": "fast", "token_type": "cache_creation.ephemeral_1h_input_tokens" } ], "starting_at": "2019-12-27T18:11:19.117Z" } ], "data_refreshed_at": "2019-12-27T18:11:19.117Z", "has_more": true, "next_page": "next_page", "organization_id": "org_013FP9SaFPBg7Kw7fetjn6cF" } ``` ## Organization › Analytics › User Cost Report ### Get Per-User Cost `$client->beta->organization->analytics->userCostReport->list(\Datetime startingAt, ?BucketWidth bucketWidth, ?list claudeTagCategories, ?list claudeTagUserIDs, ?list contextWindows, ?\Datetime endingAt, ?bool excludeDeletedUsers, ?list groupBy, ?list inferenceGeos, ?int limit, ?list models, ?Order order, ?OrderBy orderBy, ?string page, ?list products, ?list rbacGroupIDs, ?list slackChannelIDs, ?list speeds, ?list userIDs): ReportPageCursor` **GET** `/v1/organizations/analytics/user_cost_report` Get per-user cost in USD across a date range. Returns one row per user, ranked by spend. Use this to see which users account for the most cost. Only cost attributable to a seat user is included; for organization-wide totals including direct API-key and automation traffic, use the bucketed `/v1/organizations/analytics/cost_report` endpoint. Available to organizations on a Claude Enterprise plan. Requires an API key with the `read:analytics` scope. #### Parameters - `startingAt: \Datetime` (query parameter) Start of range, inclusive. RFC 3339 tz-aware. Must be within the last 365 days and no earlier than 2026-01-01T00:00:00Z. - `bucketWidth?:optional BucketWidth` (query parameter) Time-bucket granularity. When set, each row's `starting_at` and `ending_at` are populated and one actor may span several rows (one per time bucket with usage). The time bucket counts toward `limit`, so one page can return multiple rows for the same actor. `ending_at` is required when `bucket_width` is set, and with `bucket_width="1m"` the range may span at most 24 hours. When omitted, each row aggregates the full `[starting_at, ending_at)` range. - `claudeTagCategories?:optional list` (query parameter) Filter to Claude Tag (Claude in Slack) usage in specific spend categories. Usage with no category never matches. `dm` usage is reported under the user's product rather than `claude-tag`, so combining this filter with `products[]=claude-tag` excludes it. Use `group_by[]=claude_tag_category` to break out per-category values. - `claudeTagUserIDs?:optional list` (query parameter) Filter to Claude Tag (Claude in Slack) usage attributed to specific Slack users, by Slack user ID (for example `U0123ABCDEF`), not claude.ai user ID. Usage that is not Claude Tag, and Claude Tag usage not attributed to a single user, never matches. Use `group_by[]=claude_tag_user_id` to break out per-user values. - `contextWindows?:optional list` (query parameter) Filter to specific context-window pricing tiers. Use `group_by[]=context_window` to break out per-tier values. - `endingAt?:optional \Datetime` (query parameter) End of range, exclusive. When omitted, defaults to the earlier of now and `starting_at` + 31 days. The range may span at most 31 days. - `excludeDeletedUsers?:optional bool` (query parameter) If true, omit rows for users who are deleted (`deleted: true`). A page may contain fewer than `limit` rows; use `has_more` and `next_page` to paginate as usual. default: false - `groupBy?:optional list` (query parameter) Break each actor's row out by the given dimensions. Accepts the same values as the bucketed `/cost_report` endpoint. The `product`, `model`, `context_window`, `inference_geo`, and `speed` dimensions — and the time bucket, when `bucket_width` is set — count toward `limit`. `cost_type` and `token_type` do not: `cost_type` returns one row per cost component (tokens, web search, code execution); `token_type` returns one row per token type, each with `cost_type: "tokens"`; combining both returns the per-token-type rows plus the web-search and code-execution rows. A page can therefore contain more rows than `limit` when `cost_type` or `token_type` is requested. - `inferenceGeos?:optional list` (query parameter) Filter to specific inference regions. `not_available` matches rows where the region is unset. Use `group_by[]=inference_geo` to break out per-region values. - `limit?:optional int` (query parameter) Number of rows per page (1-1000, default 20). One row per actor unless `group_by[]` or `bucket_width` splits an actor across rows; `cost_type`/`token_type` fan-out rows (cost endpoint only) are the exception — they do not count toward this limit, so `data` can exceed it. default: 20 - `models?:optional list` (query parameter) Models to include. Defaults to all models. Use `group_by[]=model` to break out per-model values. - `order?:optional Order` (query parameter) Sort direction. Defaults to `desc`. default: desc - `orderBy?:optional OrderBy` (query parameter) Metric to rank actors by. Defaults to `amount`. default: amount - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page` field. - `products?:optional list` (query parameter) Product surfaces to include. Defaults to all products. - `rbacGroupIDs?:optional list` (query parameter) Filter to usage attributed to specific RBAC groups. Accepts tagged RBAC group IDs (`rbac_group_...`) or bare group UUIDs. A row matches when the user belonged to any of the listed groups on the (UTC) day the usage occurred; usage with no group attribution never matches. - `slackChannelIDs?:optional list` (query parameter) Filter to usage originating from specific Slack channels. Use `group_by[]=slack_channel_id` to break out per-channel values. - `speeds?:optional list` (query parameter) Filter to fast or standard inference mode. Use `group_by[]=speed` to break out per-mode values. - `userIDs?:optional list` (query parameter) Filter to specific users by tagged user ID. #### Returns - `class AnalyticsCostUsersItem` - `AnalyticsUserActor actor` The user this row's usage or cost is attributed to. Always a `user_actor`. - `string amount` Amount (post-discount, pre-credit) in fractional cents (minor units). - `?AnalyticsClaudeTagCategory claudeTagCategory` Claude Tag (Claude in Slack) spend category: `engaged` (a person addressed Claude in a channel or thread), `proactive` (Claude responded without being addressed), `scheduled` (a scheduled routine ran), `monitoring` (Claude watching a channel it was asked to monitor), or `dm` (direct messages with Claude). Populated only when `claude_tag_category` is in `group_by[]`; null for usage that is not Claude Tag. Direct-message usage is billed to the individual user and is reported under that user's product, not under `claude-tag`. New categories may be added over time. - `?string claudeTagUserID` Slack user ID (for example `U0123ABCDEF`) of the member the Claude Tag (Claude in Slack) usage is attributed to, not a claude.ai user ID. Populated only when `claude_tag_user_id` is in `group_by[]`; null for usage that is not Claude Tag and for Claude Tag usage that is not attributed to a single user (for example `monitoring`, and `proactive` usage Claude initiated), so per-user rows can sum to less than the Claude Tag total. Cannot be combined with `group_by[]=rbac_group_id` or the `rbac_group_ids[]` filter. - `?AnalyticsContextWindow contextWindow` Context-window pricing tier of the usage or cost. Null unless `context_window` is in `group_by[]`; it can also be null on grouped rows with no context-window tier, such as code execution. - `?AnalyticsCostType costType` Cost component breakdown; null when returning the combined total. - `string currency` Currency code for the cost amount. Currently always `"USD"`. - `?\Datetime endingAt` End of the row's UTC time bucket (exclusive), as an RFC 3339 timestamp; equal to `starting_at` plus one `bucket_width`. Null unless `bucket_width` is set. - `?InferenceGeo inferenceGeo` Inference region of the usage or cost. Null unless `inference_geo` is in `group_by[]`; it can also be null on grouped rows where the region is not set (the rows that `inference_geos[]=not_available` matches). - `string listAmount` List-price amount (pre-discount) in fractional cents. - `?string model` Model that produced the usage or cost, as a model name in the form the `models[]` filter accepts (for example, `claude-opus-5-5`). Null unless `model` is in `group_by[]`; it can also be null on grouped rows whose usage or cost is not attributed to a specific model, such as code execution. - `?string product` Product surface that produced the usage or cost. Null unless product is in `group_by[]`; it can also be null on grouped rows whose usage cannot be attributed to a known surface. Values include `chat`, `claude_code`, `cowork`, `office_agent`, `claude_in_chrome`, `claude_design`, `claude-tag`, and `chat_cowork_unified`. `claude-tag` is Claude Tag, the Claude product in Slack. `chat_cowork_unified` is Chat and Cowork unified, Cowork's features inside claude.ai chat: chat and Cowork usage by a member who has it turned on is reported under this value instead of `chat` or `cowork`. It is accepted as a filter only on deployments that offer Chat and Cowork unified. Some unattributed usage is reported as "other". - `?string rbacGroupID` RBAC group (team) the usage is attributed to, in the public tagged `rbac_group_...` spelling — the same spelling the activity resources use for this key, so the same team has one id across resources and it round-trips as an `rbac_group_ids[]` filter value. Populated only when `rbac_group_id` is in `group_by[]`. Any-membership semantics: a user in several groups contributes their full usage to each of those groups' rows, so the named-group rows overlap and their sum can exceed the org total. A null value is the single unassigned row: users in no group on that (UTC) day. For the true org total, run the same query without `group_by[]`. - `?int requests` Number of API requests in this row's scope. Null when `group_by` includes `cost_type` or `token_type` (the count has no per-component attribution; read it from the ungrouped response). For sandbox / code-execution events, this counts execution spans rather than HTTP requests (these rows surface with `product: null`). - `?string slackChannelID` Slack channel the usage originated from. Populated only when `slack_channel_id` is in `group_by[]`; null for usage outside Slack (and for rows recorded before channel attribution was enabled). - `?Speed speed` Inference speed mode of the usage or cost: `fast` or `standard`. Null unless `speed` is in `group_by[]`. - `?\Datetime startingAt` Start of the row's UTC time bucket (inclusive), as an RFC 3339 timestamp. Null unless `bucket_width` is set; without `bucket_width`, each row aggregates the full requested range. - `?AnalyticsTokenType tokenType` Token type when `cost_type` is `tokens`; null otherwise. #### Example ```php beta->organization->analytics->userCostReport->list( startingAt: new \DateTimeImmutable('2019-12-27T18:11:19.117Z'), bucketWidth: '1d', claudeTagCategories: [AnalyticsClaudeTagCategory::ENGAGED], claudeTagUserIDs: ['U0123ABCDEF'], contextWindows: [AnalyticsContextWindow::FROM_0_TO_200K], endingAt: new \DateTimeImmutable('2019-12-27T18:11:19.117Z'), excludeDeletedUsers: true, groupBy: ['claude_tag_category'], inferenceGeos: [AnalyticsInferenceGeoFilter::GLOBAL], limit: 1, models: ['string'], order: 'asc', orderBy: 'amount', page: 'page', products: [AnalyticsProductFilter::CHAT], rbacGroupIDs: ['rbac_group_012rppKaSVsmTo6NqRDXQXNF'], slackChannelIDs: ['C0123ABCDEF'], speeds: ['fast'], userIDs: ['user_01AbCdEfGhIjKlMnOpQrSt'], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "actor": { "deleted": true, "email_address": "jane@example.com", "name": "Jane Smith", "type": "user_actor", "user_id": "user_01AbCdEfGhIjKlMnOpQrSt" }, "amount": "41280.000000", "claude_tag_category": "dm", "claude_tag_user_id": "U0123ABCDEF", "context_window": "0-200k", "cost_type": "code_execution", "currency": "USD", "ending_at": "2019-12-27T18:11:19.117Z", "inference_geo": "global", "list_amount": "51600.000000", "model": "claude-opus-5-5", "product": "chat", "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "requests": 128, "slack_channel_id": "C0123ABCDEF", "speed": "fast", "starting_at": "2019-12-27T18:11:19.117Z", "token_type": "cache_creation.ephemeral_1h_input_tokens" } ], "data_refreshed_at": "2019-12-27T18:11:19.117Z", "has_more": true, "next_page": "next_page", "organization_id": "org_013FP9SaFPBg7Kw7fetjn6cF" } ``` ## Organization › Spend Limits ### Set Spend Limit `$client->beta->organization->spendLimits->set(?string amount, Scope scope, ?SpendLimitPeriod period, ?list betas): SpendLimit` **POST** `/v1/organizations/spend_limits` Set a spend limit. Upsert keyed on (scope, period): setting a limit that already exists overwrites it in place. A Claude Enterprise organization sets `user` limits. Its seat-tier, group, and organization-level defaults are configured in claude.ai. A Claude Console organization sets `organization` and `workspace` limits, which are monthly and always carry an amount. Setting those limits is in an early access preview. To request access, contact your Anthropic account team. #### Parameters - `amount: string` Limit amount as a non-negative integer decimal string in the minor unit of the organization's billing currency (cents for USD): "50000" is $500.00. `null` sets an explicit no-limit override for this scope and `period` only — each period resolves independently, so caps for other periods still apply. - `scope: Scope` What the limit applies to. Claude Enterprise organizations set `user` limits. Claude Console organizations set `organization` and `workspace` limits. Any other combination returns 400. Setting `organization` and `workspace` limits through the API is in an early access preview. To request access, contact your Anthropic account team. - `period?:optional SpendLimitPeriod` - `betas?:optional list` (header parameter) Optional header to specify the beta version(s) you want to use. #### Returns - `class SpendLimit` - `"spend_limit" type` Object type. Always `spend_limit`. - `string id` Unique tagged ID of the spend limit (`spl_...`). - `?string amount` Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies. - `\Datetime createdAt` RFC 3339 datetime at which the spend limit was created. - `string currency` ISO 4217 code of the organization's billing currency; the unit for `amount`. - `bool isEnabled` Read-only. `false` when extra usage is switched off for this organization (`organization` limit); `amount` is kept and applies again when it's switched back on. Always `true` for other limits. - `SpendLimitPeriod period` Length of the window the limit resets over. `amount` caps spend within each period. - `Scope scope` What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope. - `\Datetime updatedAt` RFC 3339 datetime at which the spend limit was last modified. #### Example ```php beta->organization->spendLimits->set( amount: '50000', scope: ['type' => 'user', 'userID' => 'user_01WCz1FkmYMm4gnmykNKUu3Q'], period: SpendLimitPeriod::MONTHLY, betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaSpendLimit); ``` ##### Response (200) ```json { "id": "id", "amount": "50000", "created_at": "2019-12-27T18:11:19.117Z", "currency": "USD", "is_enabled": true, "period": "daily", "scope": { "type": "user", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "type": "spend_limit", "updated_at": "2019-12-27T18:11:19.117Z" } ``` ### Get Spend Limit `$client->beta->organization->spendLimits->retrieve(string spendLimitID): SpendLimit` **GET** `/v1/organizations/spend_limits/{spend_limit_id}` Retrieve a spend limit by ID. #### Parameters - `spendLimitID: string` (path parameter) ID of the Spend Limit. #### Returns - `class SpendLimit` - `"spend_limit" type` Object type. Always `spend_limit`. - `string id` Unique tagged ID of the spend limit (`spl_...`). - `?string amount` Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies. - `\Datetime createdAt` RFC 3339 datetime at which the spend limit was created. - `string currency` ISO 4217 code of the organization's billing currency; the unit for `amount`. - `bool isEnabled` Read-only. `false` when extra usage is switched off for this organization (`organization` limit); `amount` is kept and applies again when it's switched back on. Always `true` for other limits. - `SpendLimitPeriod period` Length of the window the limit resets over. `amount` caps spend within each period. - `Scope scope` What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope. - `\Datetime updatedAt` RFC 3339 datetime at which the spend limit was last modified. #### Example ```php beta->organization->spendLimits->retrieve( 'spend_limit_id' ); var_dump($betaSpendLimit); ``` ##### Response (200) ```json { "id": "id", "amount": "50000", "created_at": "2019-12-27T18:11:19.117Z", "currency": "USD", "is_enabled": true, "period": "daily", "scope": { "type": "user", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "type": "spend_limit", "updated_at": "2019-12-27T18:11:19.117Z" } ``` ### Delete Spend Limit `$client->beta->organization->spendLimits->delete(string spendLimitID): SpendLimitDeleteResponse` **DELETE** `/v1/organizations/spend_limits/{spend_limit_id}` Delete a spend limit. For a Claude Enterprise organization, this deletes a per-user override, and the member falls back to any inherited spend limit at that period. Its seat-tier, group, and organization-level rows cannot be deleted via this endpoint. A Claude Console organization deletes its organization and workspace limits, but not its `usage_tier` limit. Deleting organization and workspace limits through the API is in an early access preview. #### Parameters - `spendLimitID: string` (path parameter) ID of the Spend Limit. #### Returns - `class SpendLimitDeleteResponse` - `"spend_limit_deleted" type` - `string id` #### Example ```php beta->organization->spendLimits->delete( 'spend_limit_id' ); var_dump($spendLimit); ``` ##### Response (200) ```json { "id": "id", "type": "spend_limit_deleted" } ``` ### List Spend Limits `$client->beta->organization->spendLimits->list(?int limit, ?string page, ?list scopeType, ?string workspaceID, ?list betas): PageCursor` **GET** `/v1/organizations/spend_limits` List the organization's spend limits. A Claude Console organization's limits, including any read-only `usage_tier` limit, come newest first. Listing them is in an early access preview. To request access, contact your Anthropic account team. A Claude Enterprise organization's limits are grouped by scope type, in the order `organization`, `seat_tier`, `rbac_group`, `organization_service`, `user`; within a type they come in a fixed order that is not creation order. #### Parameters - `limit?:optional int` (query parameter) Maximum number of limits per page. Defaults to `20`. default: 20 - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page` field. - `scopeType?:optional list` (query parameter) Return only limits with these scope types. Omit for all. A scope type that doesn't apply to the organization gets a 400 error. - `workspaceID?:optional string` (query parameter) Return only the limits whose `scope.workspace_id` is this workspace (`wrkspc_...`). Claude Console organizations only; other organizations get a 400 error. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `spend-limit-reads-2026-09-26` in this header. #### Returns - `class SpendLimit` - `"spend_limit" type` Object type. Always `spend_limit`. - `string id` Unique tagged ID of the spend limit (`spl_...`). - `?string amount` Limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD): "50000" is $500.00. `null` means no numeric cap is configured at this scope — see the effective report for whether a limit applies. - `\Datetime createdAt` RFC 3339 datetime at which the spend limit was created. - `string currency` ISO 4217 code of the organization's billing currency; the unit for `amount`. - `bool isEnabled` Read-only. `false` when extra usage is switched off for this organization (`organization` limit); `amount` is kept and applies again when it's switched back on. Always `true` for other limits. - `SpendLimitPeriod period` Length of the window the limit resets over. `amount` caps spend within each period. - `Scope scope` What the limit applies to. A tagged union on `type`; each variant carries the identifier for its scope. - `\Datetime updatedAt` RFC 3339 datetime at which the spend limit was last modified. #### Example ```php beta->organization->spendLimits->list( limit: 1, page: 'page', scopeType: ['organization'], workspaceID: 'workspace_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "id", "amount": "50000", "created_at": "2019-12-27T18:11:19.117Z", "currency": "USD", "is_enabled": true, "period": "daily", "scope": { "type": "user", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "type": "spend_limit", "updated_at": "2019-12-27T18:11:19.117Z" } ], "next_page": "next_page" } ``` ## Organization › Spend Limits › Effective ### List Effective Spend Limits `$client->beta->organization->spendLimits->effective->list(?int limit, ?string page, ?list period, ?list userIDs): PageCursor` **GET** `/v1/organizations/spend_limits/effective` List each member's effective spend limit and period-to-date spend. Returns one row per (member, period) the member resolves a spend limit for, with the `source` scope the spend limit was inherited from. Paginates by member, so a member's periods never split across pages. Supported for Claude Enterprise organizations only, not for Claude Console organizations. #### Parameters - `limit?:optional int` (query parameter) Maximum number of members per page. A member's period rows never split across pages, so a page may carry more rows than this. Defaults to `20`. default: 20 - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page` field. - `period?:optional list` (query parameter) Restrict the report to these limit periods. Omit to return one row per period each member resolves a spend limit for. - `userIDs?:optional list` (query parameter) Restrict the report to these members, by tagged user ID (`user_...`). At most 100 entries. #### Returns - `class SpendSummary` - `Actor actor` - `?string amount` Effective limit amount as a non-negative integer decimal string in the minor unit of `currency` (cents for USD). `null` means no limit applies for this row's `period` — each period resolves independently, so another period may still cap this member. - `string currency` ISO 4217 code of the organization's billing currency; the unit for `amount` and `period_to_date_spend`. - `SpendLimitPeriod period` Period this row's effective limit and spend are reported for. - `string periodToDateSpend` The member's spend so far in the current period, as a non-negative decimal string in the minor unit of `currency` (cents for USD). May carry fractional minor units up to three decimal places (e.g. `"12050.5"`) — metered usage is not rounded to whole cents. Reads as `"0"` when the spend reading is temporarily unavailable. - `Scope scope` - `Source source` - `string spendLimitID` #### Example ```php beta->organization->spendLimits->effective->list( limit: 1, page: 'page', period: ['daily'], userIDs: ['string'] ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "amount": "50000", "currency": "USD", "period": "daily", "period_to_date_spend": "12050.5", "scope": { "type": "user", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "source": { "type": "user", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "spend_limit_id": "spend_limit_id" } ], "next_page": "next_page" } ``` ## Organization › Spend Limits › Increase Requests ### List Spend Limit Increase Requests `$client->beta->organization->spendLimits->increaseRequests->list(?list actorIDs, ?int limit, ?string page, ?list status): PageCursor` **GET** `/v1/organizations/spend_limit_increase_requests` List spend limit increase requests, most recent first. Pending requests include a live `spend_summary` for the requester. Requests whose requester is no longer a member are excluded. #### Parameters - `actorIDs?:optional list` (query parameter) Filter by requester, as `user_...` tagged IDs. - `limit?:optional int` (query parameter) default: 20 - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page`. - `status?:optional list` (query parameter) Filter by status. Omit to return all. #### Returns - `class BetaSpendLimitIncreaseRequest` - `"spend_limit_increase_request" type` - `string id` - `Actor actor` - `\Datetime createdAt` - `SpendLimitPeriod period` - `?\Datetime resolvedAt` - `?ResolvedBy resolvedBy` - `?SpendSummary spendSummary` Per-member effective-limit report row (`GET /spend_limits/effective`). - `BetaSpendLimitIncreaseRequestStatus status` #### Example ```php beta->organization->spendLimits->increaseRequests->list( actorIDs: ['string'], limit: 1, page: 'page', status: [BetaSpendLimitIncreaseRequestStatus::APPROVED], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "id", "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "created_at": "2019-12-27T18:11:19.117Z", "period": "daily", "resolved_at": "2019-12-27T18:11:19.117Z", "resolved_by": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "spend_summary": { "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "amount": "50000", "currency": "USD", "period": "daily", "period_to_date_spend": "12050.5", "scope": { "type": "user", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "source": { "type": "user", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "spend_limit_id": "spend_limit_id" }, "status": "approved", "type": "spend_limit_increase_request" } ], "next_page": "next_page" } ``` ### Get Spend Limit Increase Request `$client->beta->organization->spendLimits->increaseRequests->retrieve(string spendLimitIncreaseRequestID): BetaSpendLimitIncreaseRequest` **GET** `/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}` Retrieve a spend limit increase request. While `pending`, the response includes a live `spend_summary` for the requester at the request's period. #### Parameters - `spendLimitIncreaseRequestID: string` (path parameter) ID of the spend limit increase request. #### Returns - `class BetaSpendLimitIncreaseRequest` - `"spend_limit_increase_request" type` - `string id` - `Actor actor` - `\Datetime createdAt` - `SpendLimitPeriod period` - `?\Datetime resolvedAt` - `?ResolvedBy resolvedBy` - `?SpendSummary spendSummary` Per-member effective-limit report row (`GET /spend_limits/effective`). - `BetaSpendLimitIncreaseRequestStatus status` #### Example ```php beta ->organization ->spendLimits ->increaseRequests ->retrieve('spend_limit_increase_request_id'); var_dump($betaSpendLimitIncreaseRequest); ``` ##### Response (200) ```json { "id": "id", "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "created_at": "2019-12-27T18:11:19.117Z", "period": "daily", "resolved_at": "2019-12-27T18:11:19.117Z", "resolved_by": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "spend_summary": { "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "amount": "50000", "currency": "USD", "period": "daily", "period_to_date_spend": "12050.5", "scope": { "type": "user", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "source": { "type": "user", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "spend_limit_id": "spend_limit_id" }, "status": "approved", "type": "spend_limit_increase_request" } ``` ### Approve Spend Limit Increase Request `$client->beta->organization->spendLimits->increaseRequests->approve(string spendLimitIncreaseRequestID, string amount, ?SpendLimitPeriod period, ?bool suppressNotification): IncreaseRequestApproveResponse` **POST** `/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}/approve` Approve a pending spend limit increase request. Writes a per-user spend limit at `amount` for the requester and transitions the request to `approved`. `period` defaults to the period the member was blocked on. Anthropic emails the requester unless `suppress_notification` is set. #### Parameters - `spendLimitIncreaseRequestID: string` (path parameter) ID of the spend limit increase request. - `amount: string` New per-user spend limit as a non-negative integer decimal string (minor units). - `period?:optional SpendLimitPeriod` - `suppressNotification?:optional bool` #### Returns - `class IncreaseRequestApproveResponse` - `"spend_limit_increase_request" type` - `string id` - `Actor actor` - `\Datetime createdAt` - `SpendLimitPeriod period` - `?\Datetime resolvedAt` - `?ResolvedBy resolvedBy` - `SpendLimit spendLimit` A configured spend limit: a cap on metered spend for one scope and period. - `?SpendSummary spendSummary` Per-member effective-limit report row (`GET /spend_limits/effective`). - `BetaSpendLimitIncreaseRequestStatus status` #### Example ```php beta->organization->spendLimits->increaseRequests->approve( 'spend_limit_increase_request_id', amount: '50000', period: SpendLimitPeriod::MONTHLY, suppressNotification: true, ); var_dump($response); ``` ##### Response (200) ```json { "id": "id", "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "created_at": "2019-12-27T18:11:19.117Z", "period": "daily", "resolved_at": "2019-12-27T18:11:19.117Z", "resolved_by": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "spend_limit": { "id": "id", "amount": "50000", "created_at": "2019-12-27T18:11:19.117Z", "currency": "USD", "is_enabled": true, "period": "daily", "scope": { "type": "user", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "type": "spend_limit", "updated_at": "2019-12-27T18:11:19.117Z" }, "spend_summary": { "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "amount": "50000", "currency": "USD", "period": "daily", "period_to_date_spend": "12050.5", "scope": { "type": "user", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "source": { "type": "user", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "spend_limit_id": "spend_limit_id" }, "status": "approved", "type": "spend_limit_increase_request" } ``` ### Deny Spend Limit Increase Request `$client->beta->organization->spendLimits->increaseRequests->deny(string spendLimitIncreaseRequestID, ?bool suppressNotification): BetaSpendLimitIncreaseRequest` **POST** `/v1/organizations/spend_limit_increase_requests/{spend_limit_increase_request_id}/deny` Deny a pending spend limit increase request. Idempotent on `denied`; denying an already-`approved` request returns 400. Anthropic emails the requester unless `suppress_notification` is set. #### Parameters - `spendLimitIncreaseRequestID: string` (path parameter) ID of the spend limit increase request. - `suppressNotification?:optional bool` #### Returns - `class BetaSpendLimitIncreaseRequest` - `"spend_limit_increase_request" type` - `string id` - `Actor actor` - `\Datetime createdAt` - `SpendLimitPeriod period` - `?\Datetime resolvedAt` - `?ResolvedBy resolvedBy` - `?SpendSummary spendSummary` Per-member effective-limit report row (`GET /spend_limits/effective`). - `BetaSpendLimitIncreaseRequestStatus status` #### Example ```php beta ->organization ->spendLimits ->increaseRequests ->deny('spend_limit_increase_request_id', suppressNotification: true); var_dump($betaSpendLimitIncreaseRequest); ``` ##### Response (200) ```json { "id": "id", "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "created_at": "2019-12-27T18:11:19.117Z", "period": "daily", "resolved_at": "2019-12-27T18:11:19.117Z", "resolved_by": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "spend_summary": { "actor": { "deleted": true, "email_address": "email_address", "name": "name", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "amount": "50000", "currency": "USD", "period": "daily", "period_to_date_spend": "12050.5", "scope": { "type": "user", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "source": { "type": "user", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "spend_limit_id": "spend_limit_id" }, "status": "approved", "type": "spend_limit_increase_request" } ``` ## Organization › RBAC Groups ### Create RBAC Group `$client->beta->organization->rbacGroups->create(string name): RBACGroup` **POST** `/v1/organizations/rbac_groups` Create an RBAC Group in the Claude Enterprise tenant. Groups created via the API have source type `"direct"`. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `name: string` Name of the RBAC Group. Not uniqueness-enforced. #### Returns - `class RBACGroup` - `"rbac_group" type` Object type. For RBAC Groups, this is always `"rbac_group"`. - `string id` ID of the RBAC Group. - `\Datetime createdAt` RFC 3339 timestamp of when the RBAC Group was created. - `string name` Name of the RBAC Group. Not uniqueness-enforced. - `?list roleIDs` RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list. - `SourceType sourceType` How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider. - `\Datetime updatedAt` RFC 3339 timestamp of when the RBAC Group was last updated. #### Example ```php beta->organization->rbacGroups->create( name: 'Engineering' ); var_dump($betaRBACGroup); ``` ##### Response (200) ```json { "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "created_at": "2024-10-30T23:58:27.427722Z", "name": "Engineering", "role_ids": [ "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s" ], "source_type": "direct", "type": "rbac_group", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ### List RBAC Groups `$client->beta->organization->rbacGroups->list(?int limit, ?string page): PageCursor` **GET** `/v1/organizations/rbac_groups` List RBAC Groups in the Claude Enterprise tenant. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. default: 20 - `page?:optional string` (query parameter) Optionally set to the `next_page` token from the previous response. #### Returns - `class RBACGroup` - `"rbac_group" type` Object type. For RBAC Groups, this is always `"rbac_group"`. - `string id` ID of the RBAC Group. - `\Datetime createdAt` RFC 3339 timestamp of when the RBAC Group was created. - `string name` Name of the RBAC Group. Not uniqueness-enforced. - `?list roleIDs` RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list. - `SourceType sourceType` How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider. - `\Datetime updatedAt` RFC 3339 timestamp of when the RBAC Group was last updated. #### Example ```php beta->organization->rbacGroups->list( limit: 1, page: 'eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9' ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "created_at": "2024-10-30T23:58:27.427722Z", "name": "Engineering", "role_ids": [ "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s" ], "source_type": "direct", "type": "rbac_group", "updated_at": "2024-10-30T23:58:27.427722Z" } ], "has_more": false, "next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9" } ``` ### Get RBAC Group `$client->beta->organization->rbacGroups->retrieve(string rbacGroupID): RBACGroup` **GET** `/v1/organizations/rbac_groups/{rbac_group_id}` Retrieve an RBAC Group by ID. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `rbacGroupID: string` (path parameter) ID of the RBAC Group. #### Returns - `class RBACGroup` - `"rbac_group" type` Object type. For RBAC Groups, this is always `"rbac_group"`. - `string id` ID of the RBAC Group. - `\Datetime createdAt` RFC 3339 timestamp of when the RBAC Group was created. - `string name` Name of the RBAC Group. Not uniqueness-enforced. - `?list roleIDs` RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list. - `SourceType sourceType` How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider. - `\Datetime updatedAt` RFC 3339 timestamp of when the RBAC Group was last updated. #### Example ```php beta->organization->rbacGroups->retrieve( 'rbac_group_id' ); var_dump($betaRBACGroup); ``` ##### Response (200) ```json { "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "created_at": "2024-10-30T23:58:27.427722Z", "name": "Engineering", "role_ids": [ "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s" ], "source_type": "direct", "type": "rbac_group", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ### Update RBAC Group `$client->beta->organization->rbacGroups->update(string rbacGroupID, ?string name): RBACGroup` **POST** `/v1/organizations/rbac_groups/{rbac_group_id}` Update an RBAC Group's name. Groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `rbacGroupID: string` (path parameter) ID of the RBAC Group. - `name?:optional string` Name of the RBAC Group. Not uniqueness-enforced. #### Returns - `class RBACGroup` - `"rbac_group" type` Object type. For RBAC Groups, this is always `"rbac_group"`. - `string id` ID of the RBAC Group. - `\Datetime createdAt` RFC 3339 timestamp of when the RBAC Group was created. - `string name` Name of the RBAC Group. Not uniqueness-enforced. - `?list roleIDs` RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list. - `SourceType sourceType` How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider. - `\Datetime updatedAt` RFC 3339 timestamp of when the RBAC Group was last updated. #### Example ```php beta->organization->rbacGroups->update( 'rbac_group_id', name: 'Engineering' ); var_dump($betaRBACGroup); ``` ##### Response (200) ```json { "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "created_at": "2024-10-30T23:58:27.427722Z", "name": "Engineering", "role_ids": [ "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s" ], "source_type": "direct", "type": "rbac_group", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ### Delete RBAC Group `$client->beta->organization->rbacGroups->delete(string rbacGroupID): RBACGroupDeleteResponse` **DELETE** `/v1/organizations/rbac_groups/{rbac_group_id}` Delete an RBAC Group. Groups provisioned by an identity provider (source type `"scim"`) cannot be deleted via the API while an organization in the tenant uses SCIM provisioning. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `rbacGroupID: string` (path parameter) ID of the RBAC Group. #### Returns - `class RBACGroupDeleteResponse` - `"rbac_group_deleted" type` Deleted object type. For RBAC Groups, this is always `"rbac_group_deleted"`. - `string id` ID of the RBAC Group. #### Example ```php beta->organization->rbacGroups->delete('rbac_group_id'); var_dump($rbacGroup); ``` ##### Response (200) ```json { "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "type": "rbac_group_deleted" } ``` ## Organization › RBAC Groups › Members ### List RBAC Group Members `$client->beta->organization->rbacGroups->members->list(string rbacGroupID, ?int limit, ?string page): PageCursor` **GET** `/v1/organizations/rbac_groups/{rbac_group_id}/members` List members of an RBAC Group. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `rbacGroupID: string` (path parameter) ID of the RBAC Group. - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. default: 20 - `page?:optional string` (query parameter) Optionally set to the `next_page` token from the previous response. #### Returns - `class BetaRBACGroupMember` - `"rbac_group_member" type` Object type. For RBAC Group Members, this is always `"rbac_group_member"`. - `\Datetime createdAt` RFC 3339 timestamp of when the User was added to the RBAC Group. - `string email` Email of the User. - `string rbacGroupID` ID of the RBAC Group. - `string userID` ID of the User. #### Example ```php beta->organization->rbacGroups->members->list( 'rbac_group_id', limit: 1, page: 'eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9' ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "created_at": "2024-10-30T23:58:27.427722Z", "email": "user@emaildomain.com", "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "type": "rbac_group_member", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" } ], "has_more": false, "next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9" } ``` ### Add RBAC Group Member `$client->beta->organization->rbacGroups->members->add(string rbacGroupID, string userID): BetaRBACGroupMember` **POST** `/v1/organizations/rbac_groups/{rbac_group_id}/members` Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `rbacGroupID: string` (path parameter) ID of the RBAC Group. - `userID: string` ID of the User. #### Returns - `class BetaRBACGroupMember` - `"rbac_group_member" type` Object type. For RBAC Group Members, this is always `"rbac_group_member"`. - `\Datetime createdAt` RFC 3339 timestamp of when the User was added to the RBAC Group. - `string email` Email of the User. - `string rbacGroupID` ID of the RBAC Group. - `string userID` ID of the User. #### Example ```php beta->organization->rbacGroups->members->add( 'rbac_group_id', userID: 'user_01WCz1FkmYMm4gnmykNKUu3Q' ); var_dump($betaRBACGroupMember); ``` ##### Response (200) ```json { "created_at": "2024-10-30T23:58:27.427722Z", "email": "user@emaildomain.com", "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "type": "rbac_group_member", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" } ``` ### Remove RBAC Group Member `$client->beta->organization->rbacGroups->members->remove(string userID, string rbacGroupID): MemberRemoveResponse` **DELETE** `/v1/organizations/rbac_groups/{rbac_group_id}/members/{user_id}` Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning. The RBAC Groups API is available to Claude Enterprise organizations only. #### Parameters - `rbacGroupID: string` (path parameter) ID of the RBAC Group. - `userID: string` (path parameter) ID of the User. #### Returns - `class MemberRemoveResponse` - `"rbac_group_member_deleted" type` Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`. - `string rbacGroupID` ID of the RBAC Group. - `string userID` ID of the User. #### Example ```php beta->organization->rbacGroups->members->remove( 'user_id', rbacGroupID: 'rbac_group_id' ); var_dump($member); ``` ##### Response (200) ```json { "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "type": "rbac_group_member_deleted", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" } ``` ## Organization › RBAC Roles ### List RBAC Roles `$client->beta->organization->rbacRoles->list(?int limit, ?string page): PageCursor` **GET** `/v1/organizations/rbac_roles` List RBAC Roles in the organization. The RBAC Roles API is available to Claude Enterprise organizations only. #### Parameters - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. default: 20 - `page?:optional string` (query parameter) Optionally set to the `next_page` token from the previous response. #### Returns - `class RBACRole` - `"rbac_role" type` Object type. For RBAC Roles, this is always `"rbac_role"`. - `string id` ID of the RBAC Role. - `\Datetime createdAt` RFC 3339 datetime string indicating when the RBAC Role was created. - `string displayName` Name of the RBAC Role. For a role created by Anthropic, this name can differ from the label claude.ai shows, and Anthropic may change the name. To keep a lasting reference to a role, store its `id`. - `\Datetime updatedAt` RFC 3339 datetime string indicating when the RBAC Role was last updated. #### Example ```php beta->organization->rbacRoles->list( limit: 1, page: 'eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0' ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s", "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "Project Editor", "type": "rbac_role", "updated_at": "2024-10-30T23:58:27.427722Z" } ], "has_more": true, "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0" } ``` ### Get RBAC Role `$client->beta->organization->rbacRoles->retrieve(string rbacRoleID): RBACRole` **GET** `/v1/organizations/rbac_roles/{rbac_role_id}` Retrieve an RBAC Role by ID. The RBAC Roles API is available to Claude Enterprise organizations only. #### Parameters - `rbacRoleID: string` (path parameter) ID of the RBAC Role. #### Returns - `class RBACRole` - `"rbac_role" type` Object type. For RBAC Roles, this is always `"rbac_role"`. - `string id` ID of the RBAC Role. - `\Datetime createdAt` RFC 3339 datetime string indicating when the RBAC Role was created. - `string displayName` Name of the RBAC Role. For a role created by Anthropic, this name can differ from the label claude.ai shows, and Anthropic may change the name. To keep a lasting reference to a role, store its `id`. - `\Datetime updatedAt` RFC 3339 datetime string indicating when the RBAC Role was last updated. #### Example ```php beta->organization->rbacRoles->retrieve( 'rbac_role_id' ); var_dump($betaRBACRole); ``` ##### Response (200) ```json { "id": "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s", "created_at": "2024-10-30T23:58:27.427722Z", "display_name": "Project Editor", "type": "rbac_role", "updated_at": "2024-10-30T23:58:27.427722Z" } ``` ## Organization › RBAC Roles › Permissions ### List RBAC Role Permissions `$client->beta->organization->rbacRoles->permissions->list(string rbacRoleID, ?int limit, ?string page): PageCursor` **GET** `/v1/organizations/rbac_roles/{rbac_role_id}/permissions` List the permissions an RBAC Role grants. The RBAC Roles API is available to Claude Enterprise organizations only. #### Parameters - `rbacRoleID: string` (path parameter) ID of the RBAC Role. - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. default: 20 - `page?:optional string` (query parameter) Optionally set to the `next_page` token from the previous response. #### Returns - `class BetaRBACRolePermission` - `"rbac_role_permission" type` Object type. For RBAC Role Permissions, this is always `"rbac_role_permission"`. - `string action` Action the permission grants on the resource. The vocabulary follows the resource: an `organization` grant carries a product-feature entitlement (for example `chat`), an admin-panel permission entitlement (`permission_*`), or a blanket capability-access mode — `capability_access_all` grants every product-feature entitlement, and `capability_access_all_ga` grants the generally-available subset as it stands at permission-check time; neither mode grants model-access entitlements. A consumer enumerating a role's per-feature grants should treat a blanket row as granting every product-feature entitlement it covers, or it will under-report the role's effective access. A `connector_tool` grant carries a tool-access action (`use` or `always_allow`); a `connector_scope` grant carries the scope action `grant` (the role may receive the named OAuth scope when tokens are minted for the connector); `connector` and `all_connectors` grants carry a tool-access action, the scope action, or an authentication-method action (`interactive` or `managed`). - `Resource resource` What the permission applies to. A tagged union: `type` names the kind of resource and determines which identifier fields are present. #### Example ```php beta->organization->rbacRoles->permissions->list( 'rbac_role_id', limit: 1, page: 'eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0' ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "action": "use", "resource": { "organization_id": "3c4f5e6d-7a8b-49c0-9d1e-2f3a4b5c6d7e", "type": "organization" }, "type": "rbac_role_permission" } ], "has_more": true, "next_page": "eyJjdXJzb3IiOiAicmJhY19yb2xlXzAxIn0" } ``` ## Organization › Plugins ### Create Plugin `$client->beta->organization->plugins->create(list files, ?string marketplaceID, ?string releaseNotes, ?list betas): Plugin` **POST** `/v1/organizations/plugins` Create an organization-owned Plugin and its first version by uploading the version's files. The upload is `multipart/form-data`: the version's files (`files`, each part sent as `files[]`), with an optional `marketplace_id` and `release_notes`. The manifest's `name` becomes the Plugin's `name`, and `display_name`, `description` and `manifest_version` come from the manifest too. `name` may contain lowercase letters (from any alphabet), digits, and hyphens, up to 64 characters. Uppercase letters, spaces, underscores, and other punctuation are rejected. The `name` must be unique within the marketplace: a name already taken returns a 409 with `error_code` `plugin_name_taken` and, when a Plugin holds it, that Plugin's ID in `details.plugin_id`. A Plugin going into the organization's library marketplace is also refused with a 409 when one of its skills has the name of an organization skill (a skill an administrator uploaded for the whole organization in claude.ai): `error_code` `skill_name_taken`, with that name in `details.skill_name`; rename the skill, or remove the organization skill in claude.ai. A 503 with `error_code` `registration_pending` means the Plugin and its version were stored (their IDs are in `details`) but are not yet usable in claude.ai: do not retry the create (the retry would return `plugin_name_taken`); create a version on the stored Plugin instead, which completes it. For a worked example, see [Create a plugin](https://platform.claude.com/docs/en/manage-claude/plugins-api?sdk_languages=php#create-a-plugin) in the Plugins API guide. **Accepted credentials:** an Admin API key with the `write:plugins` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `files: list` The version's files: one part per file, the part's filename being the file's path within the Plugin (for example `skills/review-pr/SKILL.md`), or a single `.zip` or `.plugin` archive holding them all. On the wire each part is named `files[]`, and a part named plain `files` is not read; with cURL, `-F 'files[]=@SKILL.md;filename=skills/review-pr/SKILL.md'`. The files must include the manifest, `.claude-plugin/plugin.json`. - `marketplaceID?:optional string` ID of the organization-owned plugin marketplace to create the Plugin in (prefixed `marketplace_`). It must be a `manual` marketplace, one whose Plugins are uploaded rather than synchronized from a repository. When omitted, the Plugin is created in the organization's library marketplace, an organization-owned `manual` marketplace created on first use. - `releaseNotes?:optional string` Release notes stored with the version and shown in its version history in claude.ai; up to 5,000 characters. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class Plugin` - `"plugin" type` Always `plugin`. - `string id` The Plugin's ID. - `?list components` What the served version contains; null when not enumerated. - `?PluginContentScan contentScan` The served version's content scan; null when it has not been scanned. - `\Datetime createdAt` RFC 3339. - `?CreatedBy createdBy` Who created the Plugin; null when no creator is recorded. - `?string description` The served version's description. - `?string displayName` The served version's display name. - `string latestVersionID` The newest version. - `?string manifestVersion` The served version's manifest `version`, normalized for display, or `null` (the Plugin Version's `manifest_version` says how and when). - `string marketplaceID` The ID of the plugin marketplace the Plugin lives in. - `string name` Lowercase identifier, unique within its plugin marketplace. Fixed for an organization-owned Plugin's lifetime; a member-owned Plugin's changes when its owner renames it in claude.ai, while its `id` stays the same. - `?OrganizationInstallationPreference organizationInstallationPreference` Organization-owned Plugin: the organization-wide installation setting every member gets unless an RBAC Group they belong to holds its own — the Plugin's own setting, or its plugin marketplace's default. Null for a member-owned Plugin, which has shares instead. One of `required`, `auto_install`, `available`, `not_available`; a value this API does not yet name is returned as stored. - `?bool organizationInstallationPreferenceInherited` Organization-owned Plugin: true while it has no organization-wide setting of its own and `organization_installation_preference` is its plugin marketplace's default. Null for a member-owned Plugin. - `Owner owner` Who owns the Plugin: the organization, or the member whose personal plugin marketplace it lives in. - `?Reach reach` How far the served version reaches, or `null` if it is not classified. `remote` means it declares an MCP server or a CLI. `privileged` means it declares no MCP server or CLI, but declares a hook, monitor, language server, or settings, or has a skill, command, or other Markdown file whose frontmatter pre-approves tools (`allowed-tools` with any value other than an empty one or one that names only `AskUserQuestion`, `TodoWrite`, and `ToolSearch`). Otherwise it is `contained`. If the frontmatter of a skill, command, or other Markdown file that could change the value could not be read, or was past a size limit, the version is `null` or `privileged` (or `remote`, if it declares an MCP server or a CLI), not `contained`. The value is normally worked out when a version is stored, under the rules of that time, so an older version can be `null`, or `contained` where the same files stored today would be `privileged` or `null`. - `string servedVersionID` The version claude.ai serves to members. - `bool servedVersionPinned` True once the served version has been pinned, through Update Plugin or in claude.ai. While false, a new version normally becomes the served version when it is stored. While the newest version is not the served version, as when a version saved in claude.ai is waiting for its content scan, `served_version_id` differs from `latest_version_id`. - `\Datetime updatedAt` RFC 3339. Moves on a served-version change (including pinning an unpinned Plugin to the version it already serves) and, normally, on a new version. A version saved in claude.ai that waits for its content scan moves it when it becomes the served version, and not necessarily when it is stored. A change to the Plugin's installation settings or shares does not move it. #### Example ```php beta->organization->plugins->create( files: [ FileParam::fromString('Example data', filename: uniqid('file-upload-', true)), ], marketplaceID: 'marketplace_id', releaseNotes: 'release_notes', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaPlugin); ``` ##### Response (200) ```json { "id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "components": [ { "description": "description", "name": "review-pr", "type": "skill" } ], "content_scan": { "assessment": "warn", "reason": "credential-exposure", "status": "completed" }, "created_at": "2026-03-14T09:26:53.589793Z", "created_by": { "email_address": "user@example.com", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "description": "Reviews pull requests against your team's conventions.", "display_name": "Code Review Helper", "latest_version_id": "pluginver_01KaZmQpRsTuVwXyZ2b4c6d8", "manifest_version": "1.2.0", "marketplace_id": "marketplace_01HxQ3v9KpZ2mTn8RwLc4Ys7", "name": "code-review-helper", "organization_installation_preference": "available", "organization_installation_preference_inherited": true, "owner": { "type": "organization" }, "reach": "contained", "served_version_id": "pluginver_01K9wPcHd4Rm2Tx8Vq6Ln3Sb", "served_version_pinned": true, "type": "plugin", "updated_at": "2026-03-14T09:26:53.589793Z" } ``` ### Get Plugin `$client->beta->organization->plugins->retrieve(string pluginID, ?string organizationID, ?list betas): Plugin` **GET** `/v1/organizations/plugins/{plugin_id}` Retrieve a Plugin by ID. **Accepted credentials:** an Admin API key with the `read:plugins` or `read:org_audit` scope, or a Compliance Access Key with the `read:compliance_org_data` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `organizationID?:optional string` (query parameter) For a `read:org_audit` or `read:compliance_org_data` key created for all of a parent organization's linked organizations: a child organization of that parent to read instead of the organization the key was created in, given as the organization's UUID or its `org_`-prefixed ID. A value that is neither returns a 400; an organization that is not a child of the key's parent, or where the Plugins API is not available, returns a 404. Any other key may pass only its own organization's ID here; another organization returns a 404. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class Plugin` - `"plugin" type` Always `plugin`. - `string id` The Plugin's ID. - `?list components` What the served version contains; null when not enumerated. - `?PluginContentScan contentScan` The served version's content scan; null when it has not been scanned. - `\Datetime createdAt` RFC 3339. - `?CreatedBy createdBy` Who created the Plugin; null when no creator is recorded. - `?string description` The served version's description. - `?string displayName` The served version's display name. - `string latestVersionID` The newest version. - `?string manifestVersion` The served version's manifest `version`, normalized for display, or `null` (the Plugin Version's `manifest_version` says how and when). - `string marketplaceID` The ID of the plugin marketplace the Plugin lives in. - `string name` Lowercase identifier, unique within its plugin marketplace. Fixed for an organization-owned Plugin's lifetime; a member-owned Plugin's changes when its owner renames it in claude.ai, while its `id` stays the same. - `?OrganizationInstallationPreference organizationInstallationPreference` Organization-owned Plugin: the organization-wide installation setting every member gets unless an RBAC Group they belong to holds its own — the Plugin's own setting, or its plugin marketplace's default. Null for a member-owned Plugin, which has shares instead. One of `required`, `auto_install`, `available`, `not_available`; a value this API does not yet name is returned as stored. - `?bool organizationInstallationPreferenceInherited` Organization-owned Plugin: true while it has no organization-wide setting of its own and `organization_installation_preference` is its plugin marketplace's default. Null for a member-owned Plugin. - `Owner owner` Who owns the Plugin: the organization, or the member whose personal plugin marketplace it lives in. - `?Reach reach` How far the served version reaches, or `null` if it is not classified. `remote` means it declares an MCP server or a CLI. `privileged` means it declares no MCP server or CLI, but declares a hook, monitor, language server, or settings, or has a skill, command, or other Markdown file whose frontmatter pre-approves tools (`allowed-tools` with any value other than an empty one or one that names only `AskUserQuestion`, `TodoWrite`, and `ToolSearch`). Otherwise it is `contained`. If the frontmatter of a skill, command, or other Markdown file that could change the value could not be read, or was past a size limit, the version is `null` or `privileged` (or `remote`, if it declares an MCP server or a CLI), not `contained`. The value is normally worked out when a version is stored, under the rules of that time, so an older version can be `null`, or `contained` where the same files stored today would be `privileged` or `null`. - `string servedVersionID` The version claude.ai serves to members. - `bool servedVersionPinned` True once the served version has been pinned, through Update Plugin or in claude.ai. While false, a new version normally becomes the served version when it is stored. While the newest version is not the served version, as when a version saved in claude.ai is waiting for its content scan, `served_version_id` differs from `latest_version_id`. - `\Datetime updatedAt` RFC 3339. Moves on a served-version change (including pinning an unpinned Plugin to the version it already serves) and, normally, on a new version. A version saved in claude.ai that waits for its content scan moves it when it becomes the served version, and not necessarily when it is stored. A change to the Plugin's installation settings or shares does not move it. #### Example ```php beta->organization->plugins->retrieve( 'plugin_id', organizationID: 'organization_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaPlugin); ``` ##### Response (200) ```json { "id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "components": [ { "description": "description", "name": "review-pr", "type": "skill" } ], "content_scan": { "assessment": "warn", "reason": "credential-exposure", "status": "completed" }, "created_at": "2026-03-14T09:26:53.589793Z", "created_by": { "email_address": "user@example.com", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "description": "Reviews pull requests against your team's conventions.", "display_name": "Code Review Helper", "latest_version_id": "pluginver_01KaZmQpRsTuVwXyZ2b4c6d8", "manifest_version": "1.2.0", "marketplace_id": "marketplace_01HxQ3v9KpZ2mTn8RwLc4Ys7", "name": "code-review-helper", "organization_installation_preference": "available", "organization_installation_preference_inherited": true, "owner": { "type": "organization" }, "reach": "contained", "served_version_id": "pluginver_01K9wPcHd4Rm2Tx8Vq6Ln3Sb", "served_version_pinned": true, "type": "plugin", "updated_at": "2026-03-14T09:26:53.589793Z" } ``` ### Update Plugin `$client->beta->organization->plugins->update(string pluginID, string servedVersionID, ?list betas): Plugin` **POST** `/v1/organizations/plugins/{plugin_id}` Change which stored version of an organization-owned Plugin is served to members, for example to roll back to an earlier one. This pins the served version: later uploads are stored but no longer change what is served, and pinning cannot currently be undone, here or in claude.ai. Pass the version as `served_version_id`: an earlier one to roll back, a later one to start serving a version that was stored without being served, or the one already served to pin it without changing what is served. No new version is created. When the organization has content scanning enabled, a version whose `content_scan.status` is `processing` is refused with a 409 (`error_code` `scan_pending`; retry once the scan finishes). A version whose `content_scan.status` is `errored`, or whose `content_scan.assessment` is `fail` or `unknown`, is refused with a 400 (`error_code` `scan_failed`); a `warn` is accepted. If the scan outcome cannot be read at that moment, the request fails with a retryable 503 instead. When the Plugin is in the organization's library marketplace, a version other than the one served is also refused with a 409 when one of its skills has a name that an organization skill (one an administrator uploaded for the whole organization in claude.ai) has since taken: `error_code` `skill_name_taken`, with that name in `details.skill_name`. A member-owned Plugin cannot be updated here (403). This endpoint does not write installation settings; they are written at `/v1/organizations/plugins/{plugin_id}/installation_settings/{target}`. **Accepted credentials:** an Admin API key with the `write:plugins` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `servedVersionID: string` Serve this version of the Plugin (prefixed `pluginver_`) and pin the served version to it; `latest` is not accepted. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class Plugin` - `"plugin" type` Always `plugin`. - `string id` The Plugin's ID. - `?list components` What the served version contains; null when not enumerated. - `?PluginContentScan contentScan` The served version's content scan; null when it has not been scanned. - `\Datetime createdAt` RFC 3339. - `?CreatedBy createdBy` Who created the Plugin; null when no creator is recorded. - `?string description` The served version's description. - `?string displayName` The served version's display name. - `string latestVersionID` The newest version. - `?string manifestVersion` The served version's manifest `version`, normalized for display, or `null` (the Plugin Version's `manifest_version` says how and when). - `string marketplaceID` The ID of the plugin marketplace the Plugin lives in. - `string name` Lowercase identifier, unique within its plugin marketplace. Fixed for an organization-owned Plugin's lifetime; a member-owned Plugin's changes when its owner renames it in claude.ai, while its `id` stays the same. - `?OrganizationInstallationPreference organizationInstallationPreference` Organization-owned Plugin: the organization-wide installation setting every member gets unless an RBAC Group they belong to holds its own — the Plugin's own setting, or its plugin marketplace's default. Null for a member-owned Plugin, which has shares instead. One of `required`, `auto_install`, `available`, `not_available`; a value this API does not yet name is returned as stored. - `?bool organizationInstallationPreferenceInherited` Organization-owned Plugin: true while it has no organization-wide setting of its own and `organization_installation_preference` is its plugin marketplace's default. Null for a member-owned Plugin. - `Owner owner` Who owns the Plugin: the organization, or the member whose personal plugin marketplace it lives in. - `?Reach reach` How far the served version reaches, or `null` if it is not classified. `remote` means it declares an MCP server or a CLI. `privileged` means it declares no MCP server or CLI, but declares a hook, monitor, language server, or settings, or has a skill, command, or other Markdown file whose frontmatter pre-approves tools (`allowed-tools` with any value other than an empty one or one that names only `AskUserQuestion`, `TodoWrite`, and `ToolSearch`). Otherwise it is `contained`. If the frontmatter of a skill, command, or other Markdown file that could change the value could not be read, or was past a size limit, the version is `null` or `privileged` (or `remote`, if it declares an MCP server or a CLI), not `contained`. The value is normally worked out when a version is stored, under the rules of that time, so an older version can be `null`, or `contained` where the same files stored today would be `privileged` or `null`. - `string servedVersionID` The version claude.ai serves to members. - `bool servedVersionPinned` True once the served version has been pinned, through Update Plugin or in claude.ai. While false, a new version normally becomes the served version when it is stored. While the newest version is not the served version, as when a version saved in claude.ai is waiting for its content scan, `served_version_id` differs from `latest_version_id`. - `\Datetime updatedAt` RFC 3339. Moves on a served-version change (including pinning an unpinned Plugin to the version it already serves) and, normally, on a new version. A version saved in claude.ai that waits for its content scan moves it when it becomes the served version, and not necessarily when it is stored. A change to the Plugin's installation settings or shares does not move it. #### Example ```php beta->organization->plugins->update( 'plugin_id', servedVersionID: 'pluginver_01KaZmQpRsTuVwXyZ2b4c6d8', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaPlugin); ``` ##### Response (200) ```json { "id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "components": [ { "description": "description", "name": "review-pr", "type": "skill" } ], "content_scan": { "assessment": "warn", "reason": "credential-exposure", "status": "completed" }, "created_at": "2026-03-14T09:26:53.589793Z", "created_by": { "email_address": "user@example.com", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "description": "Reviews pull requests against your team's conventions.", "display_name": "Code Review Helper", "latest_version_id": "pluginver_01KaZmQpRsTuVwXyZ2b4c6d8", "manifest_version": "1.2.0", "marketplace_id": "marketplace_01HxQ3v9KpZ2mTn8RwLc4Ys7", "name": "code-review-helper", "organization_installation_preference": "available", "organization_installation_preference_inherited": true, "owner": { "type": "organization" }, "reach": "contained", "served_version_id": "pluginver_01K9wPcHd4Rm2Tx8Vq6Ln3Sb", "served_version_pinned": true, "type": "plugin", "updated_at": "2026-03-14T09:26:53.589793Z" } ``` ### List Plugins `$client->beta->organization->plugins->list(?\Datetime createdAtGt, ?\Datetime createdAtGte, ?\Datetime createdAtLt, ?\Datetime createdAtLte, ?int limit, ?string marketplaceID, ?string organizationID, ?OwnerType ownerType, ?string ownerUserID, ?string page, ?list betas): PageCursor` **GET** `/v1/organizations/plugins` List the Plugins created under the organization, newest first: those in the organization's own plugin marketplaces and those in members' personal plugin marketplaces. Plugins in members' personal marketplaces are listed with the same detail as the organization's own, and their files can be downloaded through the version archive endpoint, which records each such download on the Compliance API activity feed. **Accepted credentials:** an Admin API key with the `read:plugins` or `read:org_audit` scope, or a Compliance Access Key with the `read:compliance_org_data` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `createdAtGt?:optional \Datetime` (query parameter) RFC 3339 timestamp bound; combine [gte], [gt], [lte], [lt]. - `createdAtGte?:optional \Datetime` (query parameter) RFC 3339 timestamp bound; combine [gte], [gt], [lte], [lt]. - `createdAtLt?:optional \Datetime` (query parameter) RFC 3339 timestamp bound; combine [gte], [gt], [lte], [lt]. - `createdAtLte?:optional \Datetime` (query parameter) RFC 3339 timestamp bound; combine [gte], [gt], [lte], [lt]. - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `100`. default: 20 - `marketplaceID?:optional string` (query parameter) Only Plugins in this plugin marketplace (prefixed `marketplace_`). - `organizationID?:optional string` (query parameter) For a `read:org_audit` or `read:compliance_org_data` key created for all of a parent organization's linked organizations: a child organization of that parent to read instead of the organization the key was created in, given as the organization's UUID or its `org_`-prefixed ID. A value that is neither returns a 400; an organization that is not a child of the key's parent, or where the Plugins API is not available, returns a 404. Any other key may pass only its own organization's ID here; another organization returns a 404. - `ownerType?:optional OwnerType` (query parameter) `organization` for Plugins in the organization's plugin marketplaces, `user` for Plugins in members' personal plugin marketplaces. - `ownerUserID?:optional string` (query parameter) Only Plugins in this member's personal plugin marketplaces (prefixed `user_`); a removed member's ID is accepted. - `page?:optional string` (query parameter) Optionally set to the `next_page` token from the previous response. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class Plugin` - `"plugin" type` Always `plugin`. - `string id` The Plugin's ID. - `?list components` What the served version contains; null when not enumerated. - `?PluginContentScan contentScan` The served version's content scan; null when it has not been scanned. - `\Datetime createdAt` RFC 3339. - `?CreatedBy createdBy` Who created the Plugin; null when no creator is recorded. - `?string description` The served version's description. - `?string displayName` The served version's display name. - `string latestVersionID` The newest version. - `?string manifestVersion` The served version's manifest `version`, normalized for display, or `null` (the Plugin Version's `manifest_version` says how and when). - `string marketplaceID` The ID of the plugin marketplace the Plugin lives in. - `string name` Lowercase identifier, unique within its plugin marketplace. Fixed for an organization-owned Plugin's lifetime; a member-owned Plugin's changes when its owner renames it in claude.ai, while its `id` stays the same. - `?OrganizationInstallationPreference organizationInstallationPreference` Organization-owned Plugin: the organization-wide installation setting every member gets unless an RBAC Group they belong to holds its own — the Plugin's own setting, or its plugin marketplace's default. Null for a member-owned Plugin, which has shares instead. One of `required`, `auto_install`, `available`, `not_available`; a value this API does not yet name is returned as stored. - `?bool organizationInstallationPreferenceInherited` Organization-owned Plugin: true while it has no organization-wide setting of its own and `organization_installation_preference` is its plugin marketplace's default. Null for a member-owned Plugin. - `Owner owner` Who owns the Plugin: the organization, or the member whose personal plugin marketplace it lives in. - `?Reach reach` How far the served version reaches, or `null` if it is not classified. `remote` means it declares an MCP server or a CLI. `privileged` means it declares no MCP server or CLI, but declares a hook, monitor, language server, or settings, or has a skill, command, or other Markdown file whose frontmatter pre-approves tools (`allowed-tools` with any value other than an empty one or one that names only `AskUserQuestion`, `TodoWrite`, and `ToolSearch`). Otherwise it is `contained`. If the frontmatter of a skill, command, or other Markdown file that could change the value could not be read, or was past a size limit, the version is `null` or `privileged` (or `remote`, if it declares an MCP server or a CLI), not `contained`. The value is normally worked out when a version is stored, under the rules of that time, so an older version can be `null`, or `contained` where the same files stored today would be `privileged` or `null`. - `string servedVersionID` The version claude.ai serves to members. - `bool servedVersionPinned` True once the served version has been pinned, through Update Plugin or in claude.ai. While false, a new version normally becomes the served version when it is stored. While the newest version is not the served version, as when a version saved in claude.ai is waiting for its content scan, `served_version_id` differs from `latest_version_id`. - `\Datetime updatedAt` RFC 3339. Moves on a served-version change (including pinning an unpinned Plugin to the version it already serves) and, normally, on a new version. A version saved in claude.ai that waits for its content scan moves it when it becomes the served version, and not necessarily when it is stored. A change to the Plugin's installation settings or shares does not move it. #### Example ```php beta->organization->plugins->list( createdAtGt: new \DateTimeImmutable('2019-12-27T18:11:19.117Z'), createdAtGte: new \DateTimeImmutable('2019-12-27T18:11:19.117Z'), createdAtLt: new \DateTimeImmutable('2019-12-27T18:11:19.117Z'), createdAtLte: new \DateTimeImmutable('2019-12-27T18:11:19.117Z'), limit: 1, marketplaceID: 'marketplace_id', organizationID: 'organization_id', ownerType: 'organization', ownerUserID: 'owner_user_id', page: 'page', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "components": [ { "description": "description", "name": "review-pr", "type": "skill" } ], "content_scan": { "assessment": "warn", "reason": "credential-exposure", "status": "completed" }, "created_at": "2026-03-14T09:26:53.589793Z", "created_by": { "email_address": "user@example.com", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "description": "Reviews pull requests against your team's conventions.", "display_name": "Code Review Helper", "latest_version_id": "pluginver_01KaZmQpRsTuVwXyZ2b4c6d8", "manifest_version": "1.2.0", "marketplace_id": "marketplace_01HxQ3v9KpZ2mTn8RwLc4Ys7", "name": "code-review-helper", "organization_installation_preference": "available", "organization_installation_preference_inherited": true, "owner": { "type": "organization" }, "reach": "contained", "served_version_id": "pluginver_01K9wPcHd4Rm2Tx8Vq6Ln3Sb", "served_version_pinned": true, "type": "plugin", "updated_at": "2026-03-14T09:26:53.589793Z" } ], "next_page": "page_MjAyNi0wOS0xNlQxNDowNTowOVo" } ``` ### Delete Plugin `$client->beta->organization->plugins->delete(string pluginID, ?list betas): DeletedPlugin` **DELETE** `/v1/organizations/plugins/{plugin_id}` Permanently delete a Plugin and every version it holds, exactly as when an administrator deletes it in claude.ai. The Plugin may belong to the organization or to a member, including a member who has since left the organization. An organization-owned Plugin's installation settings go with it; a member-owned Plugin's shares are withdrawn and its owner no longer has it. To take an organization-owned Plugin out of use reversibly, set its organization-wide installation setting to `not_available` instead (and remove or change any group settings, which override it for their members). Only a Plugin in a `manual` marketplace can be deleted here; one synchronized from a repository is removed by removing it from the repository (400). **Accepted credentials:** an Admin API key with the `write:plugins` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class DeletedPlugin` - `"plugin_deleted" type` Always `plugin_deleted`. - `string id` The deleted Plugin's ID. #### Example ```php beta->organization->plugins->delete( 'plugin_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24] ); var_dump($betaDeletedPlugin); ``` ##### Response (200) ```json { "id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "type": "plugin_deleted" } ``` ## Organization › Plugins › Versions ### Create Plugin Version `$client->beta->organization->plugins->versions->create(string pluginID, list files, ?string releaseNotes, ?list betas): BetaPluginVersion` **POST** `/v1/organizations/plugins/{plugin_id}/versions` Add a version to an organization-owned Plugin by uploading the new version's files; it becomes the version served to members unless the Plugin's served version has been pinned. The upload is the same `multipart/form-data` as creating a Plugin: the version's files (`files`, each part sent as `files[]`) and optional `release_notes`. The uploaded manifest's `name` must equal the Plugin's `name`. Returns the stored version; read the Plugin back to see which version it serves. Only a Plugin in a `manual` marketplace takes uploads; a Plugin synchronized from a repository gets its versions from the repository. When the Plugin is in the organization's library marketplace, a version that adds a skill with the name of an organization skill (a skill an administrator uploaded for the whole organization in claude.ai) is refused with a 409: `error_code` `skill_name_taken`, with that name in `details.skill_name`. A 503 with `error_code` `registration_pending` means the version was stored but is not yet usable; a later version create on the Plugin completes it. For a worked example, see [Create a version](https://platform.claude.com/docs/en/manage-claude/plugins-api?sdk_languages=php#create-a-version) in the Plugins API guide. **Accepted credentials:** an Admin API key with the `write:plugins` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `files: list` The version's files: one part per file, the part's filename being the file's path within the Plugin (for example `skills/review-pr/SKILL.md`), or a single `.zip` or `.plugin` archive holding them all. On the wire each part is named `files[]`, and a part named plain `files` is not read; with cURL, `-F 'files[]=@SKILL.md;filename=skills/review-pr/SKILL.md'`. The files must include the manifest, `.claude-plugin/plugin.json`. - `releaseNotes?:optional string` Release notes stored with the version and shown in its version history in claude.ai; up to 5,000 characters. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class BetaPluginVersion` - `"plugin_version" type` Always `plugin_version`. - `string id` The version's ID. - `?list components` What the version contains; null when not enumerated. - `?PluginContentScan contentScan` This version's content scan; null when it has not been scanned. - `\Datetime createdAt` RFC 3339. - `?CreatedBy createdBy` Who uploaded this version; null when not recorded. - `?string description` The manifest's description; null when it declares none. - `?string displayName` The manifest's display name; null when it declares none. - `?string manifestVersion` The manifest's `version`, normalized for display: one leading `v` or `V` is dropped, and the result is returned only if it is 1 to 64 characters, starts with a digit, and uses only ASCII letters, digits, `.`, `+`, and `-`; otherwise `null`. For example, `"v1.4.0"` is returned as `"1.4.0"`, and `"latest"` as `null`. For a synchronized plugin, the `version` of its `marketplace.json` entry can take the place of the manifest's `version`. It is also `null` for a version stored before claude.ai began recording this field (August 2026). - `string pluginID` The Plugin's ID. - `?Reach reach` How far the version reaches: `remote`, `privileged`, `contained`, or `null`, as defined on the Plugin's `reach`. - `?string releaseNotes` As supplied with the upload; null when none were supplied. #### Example ```php beta->organization->plugins->versions->create( 'plugin_id', files: [ FileParam::fromString('Example data', filename: uniqid('file-upload-', true)), ], releaseNotes: 'release_notes', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaPluginVersion); ``` ##### Response (200) ```json { "id": "pluginver_01KaZmQpRsTuVwXyZ2b4c6d8", "components": [ { "description": "description", "name": "review-pr", "type": "skill" } ], "content_scan": { "assessment": "warn", "reason": "credential-exposure", "status": "completed" }, "created_at": "2026-03-14T09:26:53.589793Z", "created_by": { "email_address": "user@example.com", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "description": "Reviews pull requests against your team's conventions.", "display_name": "Code Review Helper", "manifest_version": "1.2.0", "plugin_id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "reach": "contained", "release_notes": "Adds a review checklist for database migrations.", "type": "plugin_version" } ``` ### List Plugin Versions `$client->beta->organization->plugins->versions->list(string pluginID, ?int limit, ?string organizationID, ?string page, ?list betas): PageCursor` **GET** `/v1/organizations/plugins/{plugin_id}/versions` List a Plugin's versions, newest first. The first item of the first page is the version the Plugin's `latest_version_id` refers to. **Accepted credentials:** an Admin API key with the `read:plugins` or `read:org_audit` scope, or a Compliance Access Key with the `read:compliance_org_data` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. default: 20 - `organizationID?:optional string` (query parameter) For a `read:org_audit` or `read:compliance_org_data` key created for all of a parent organization's linked organizations: a child organization of that parent to read instead of the organization the key was created in, given as the organization's UUID or its `org_`-prefixed ID. A value that is neither returns a 400; an organization that is not a child of the key's parent, or where the Plugins API is not available, returns a 404. Any other key may pass only its own organization's ID here; another organization returns a 404. - `page?:optional string` (query parameter) Optionally set to the `next_page` token from the previous response. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class BetaPluginVersion` - `"plugin_version" type` Always `plugin_version`. - `string id` The version's ID. - `?list components` What the version contains; null when not enumerated. - `?PluginContentScan contentScan` This version's content scan; null when it has not been scanned. - `\Datetime createdAt` RFC 3339. - `?CreatedBy createdBy` Who uploaded this version; null when not recorded. - `?string description` The manifest's description; null when it declares none. - `?string displayName` The manifest's display name; null when it declares none. - `?string manifestVersion` The manifest's `version`, normalized for display: one leading `v` or `V` is dropped, and the result is returned only if it is 1 to 64 characters, starts with a digit, and uses only ASCII letters, digits, `.`, `+`, and `-`; otherwise `null`. For example, `"v1.4.0"` is returned as `"1.4.0"`, and `"latest"` as `null`. For a synchronized plugin, the `version` of its `marketplace.json` entry can take the place of the manifest's `version`. It is also `null` for a version stored before claude.ai began recording this field (August 2026). - `string pluginID` The Plugin's ID. - `?Reach reach` How far the version reaches: `remote`, `privileged`, `contained`, or `null`, as defined on the Plugin's `reach`. - `?string releaseNotes` As supplied with the upload; null when none were supplied. #### Example ```php beta->organization->plugins->versions->list( 'plugin_id', limit: 1, organizationID: 'organization_id', page: 'page', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "pluginver_01KaZmQpRsTuVwXyZ2b4c6d8", "components": [ { "description": "description", "name": "review-pr", "type": "skill" } ], "content_scan": { "assessment": "warn", "reason": "credential-exposure", "status": "completed" }, "created_at": "2026-03-14T09:26:53.589793Z", "created_by": { "email_address": "user@example.com", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "description": "Reviews pull requests against your team's conventions.", "display_name": "Code Review Helper", "manifest_version": "1.2.0", "plugin_id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "reach": "contained", "release_notes": "Adds a review checklist for database migrations.", "type": "plugin_version" } ], "next_page": "page_MjAyNi0wOS0xNlQxNDowNTowOVo" } ``` ### Get Plugin Version `$client->beta->organization->plugins->versions->retrieve(string version, string pluginID, ?string organizationID, ?list betas): BetaPluginVersion` **GET** `/v1/organizations/plugins/{plugin_id}/versions/{version}` Retrieve one version of a Plugin by its ID, or the Plugin's newest version. **Accepted credentials:** an Admin API key with the `read:plugins` or `read:org_audit` scope, or a Compliance Access Key with the `read:compliance_org_data` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `version: string` (path parameter) ID of the Plugin Version (prefixed `pluginver_`), or `latest` for the newest one. - `organizationID?:optional string` (query parameter) For a `read:org_audit` or `read:compliance_org_data` key created for all of a parent organization's linked organizations: a child organization of that parent to read instead of the organization the key was created in, given as the organization's UUID or its `org_`-prefixed ID. A value that is neither returns a 400; an organization that is not a child of the key's parent, or where the Plugins API is not available, returns a 404. Any other key may pass only its own organization's ID here; another organization returns a 404. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class BetaPluginVersion` - `"plugin_version" type` Always `plugin_version`. - `string id` The version's ID. - `?list components` What the version contains; null when not enumerated. - `?PluginContentScan contentScan` This version's content scan; null when it has not been scanned. - `\Datetime createdAt` RFC 3339. - `?CreatedBy createdBy` Who uploaded this version; null when not recorded. - `?string description` The manifest's description; null when it declares none. - `?string displayName` The manifest's display name; null when it declares none. - `?string manifestVersion` The manifest's `version`, normalized for display: one leading `v` or `V` is dropped, and the result is returned only if it is 1 to 64 characters, starts with a digit, and uses only ASCII letters, digits, `.`, `+`, and `-`; otherwise `null`. For example, `"v1.4.0"` is returned as `"1.4.0"`, and `"latest"` as `null`. For a synchronized plugin, the `version` of its `marketplace.json` entry can take the place of the manifest's `version`. It is also `null` for a version stored before claude.ai began recording this field (August 2026). - `string pluginID` The Plugin's ID. - `?Reach reach` How far the version reaches: `remote`, `privileged`, `contained`, or `null`, as defined on the Plugin's `reach`. - `?string releaseNotes` As supplied with the upload; null when none were supplied. #### Example ```php beta->organization->plugins->versions->retrieve( 'version', pluginID: 'plugin_id', organizationID: 'organization_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaPluginVersion); ``` ##### Response (200) ```json { "id": "pluginver_01KaZmQpRsTuVwXyZ2b4c6d8", "components": [ { "description": "description", "name": "review-pr", "type": "skill" } ], "content_scan": { "assessment": "warn", "reason": "credential-exposure", "status": "completed" }, "created_at": "2026-03-14T09:26:53.589793Z", "created_by": { "email_address": "user@example.com", "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "description": "Reviews pull requests against your team's conventions.", "display_name": "Code Review Helper", "manifest_version": "1.2.0", "plugin_id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "reach": "contained", "release_notes": "Adds a review checklist for database migrations.", "type": "plugin_version" } ``` ### Download Plugin Version Archive `$client->beta->organization->plugins->versions->download(string version, string pluginID, ?string organizationID, ?list betas): download` **GET** `/v1/organizations/plugins/{plugin_id}/versions/{version}/content` Download one version's `.zip` archive, exactly as stored. Each download of a Plugin from a member's personal plugin marketplace is recorded on the Compliance API activity feed. The response body is the archive (`Content-Type: application/zip`), sent as an attachment whose filename is derived from the Plugin's name; name saved files from the IDs in the request path, since that filename is not unique. **Accepted credentials:** an Admin API key with the `read:plugins` or `read:org_audit` scope, or a Compliance Access Key with the `read:compliance_org_data` scope. Every read scope above (`read:plugins`, `read:org_audit`, and `read:compliance_org_data`) can download the files of plugins in members' personal marketplaces, including files that claude.ai's admin settings do not show, and a `read:org_audit` or `read:compliance_org_data` key created for all of your parent organization's linked organizations can do this in any organization under it that has access to this API, by passing `organization_id`. Each such download records a `claude_plugin_archive_accessed` event on the Compliance API activity feed, identifying the key, the plugin, the version, and the member. Downloads of organization-owned plugins are not recorded. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `version: string` (path parameter) ID of the Plugin Version (prefixed `pluginver_`). `latest` is not accepted here. - `organizationID?:optional string` (query parameter) For a `read:org_audit` or `read:compliance_org_data` key created for all of a parent organization's linked organizations: a child organization of that parent to read instead of the organization the key was created in, given as the organization's UUID or its `org_`-prefixed ID. A value that is neither returns a 400; an organization that is not a child of the key's parent, or where the Plugins API is not available, returns a 404. Any other key may pass only its own organization's ID here; another organization returns a 404. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `mixed` #### Example ```php beta->organization->plugins->versions->download( 'version', pluginID: 'plugin_id', organizationID: 'organization_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($response); ``` ## Organization › Plugins › Installation Settings ### List Plugin Installation Settings `$client->beta->organization->plugins->installationSettings->list(string pluginID, ?int limit, ?string organizationID, ?string page, ?TargetType targetType, ?list betas): PageCursor` **GET** `/v1/organizations/plugins/{plugin_id}/installation_settings` List an organization-owned Plugin's installation settings, which say which members it is for, most recently created first. The list holds the Plugin's own organization-wide setting (absent while the Plugin inherits its marketplace's default) and each RBAC Group's own setting. A member-owned Plugin has shares instead, so this path returns 404 for one. **Accepted credentials:** an Admin API key with the `read:plugins` or `read:org_audit` scope, or a Compliance Access Key with the `read:compliance_org_data` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `100`. default: 20 - `organizationID?:optional string` (query parameter) For a `read:org_audit` or `read:compliance_org_data` key created for all of a parent organization's linked organizations: a child organization of that parent to read instead of the organization the key was created in, given as the organization's UUID or its `org_`-prefixed ID. A value that is neither returns a 400; an organization that is not a child of the key's parent, or where the Plugins API is not available, returns a 404. Any other key may pass only its own organization's ID here; another organization returns a 404. - `page?:optional string` (query parameter) Optionally set to the `next_page` token from the previous response. - `targetType?:optional TargetType` (query parameter) Only settings for this kind of target: `organization` (the organization-wide setting) or `rbac_group` (an RBAC Group's). - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class BetaPluginInstallationSetting` - `"plugin_installation_setting" type` Always `plugin_installation_setting`. - `\Datetime createdAt` When the target was first given a setting for this Plugin. - `InstallationPreference installationPreference` The setting the target holds for this Plugin. One of `required`, `auto_install`, `available`, `not_available`; a value this API does not yet name is returned as stored. - `string pluginID` The Plugin's ID. - `Target target` Whose setting this is: `organization` (the Plugin's own organization-wide setting) or `rbac_group` (one RBAC Group's own setting); `organization_member` does not occur here. - `\Datetime updatedAt` When its setting last changed. #### Example ```php beta->organization->plugins->installationSettings->list( 'plugin_id', limit: 1, organizationID: 'organization_id', page: 'page', targetType: 'organization', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "created_at": "2026-03-14T09:26:53.589793Z", "installation_preference": "required", "plugin_id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "target": { "type": "organization" }, "type": "plugin_installation_setting", "updated_at": "2026-03-14T09:26:53.589793Z" } ], "next_page": "page_MjAyNi0wOS0xNlQxNDowNTowOVo" } ``` ### Set Plugin Installation Setting `$client->beta->organization->plugins->installationSettings->set(string target, string pluginID, InstallationPreference installationPreference, ?list betas): BetaPluginInstallationSetting` **POST** `/v1/organizations/plugins/{plugin_id}/installation_settings/{target}` Set or change an organization-owned Plugin's installation setting for the whole organization or for one RBAC Group. Writing the value a target already holds of its own changes nothing. A member-owned Plugin has shares instead of installation settings, so this path returns 404 for one. Send a Plugin's installation-setting writes one at a time. If several writes for the same Plugin arrive at the same time, the server handles them one after another and can answer some of them with `503` instead of applying them. That `503` carries `x-should-retry: true`, and the write is safe to repeat: wait a second or two, then send it again. **Accepted credentials:** an Admin API key with the `write:plugins` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `target: string` (path parameter) The target whose setting is written: the literal `organization` for the Plugin's organization-wide setting, or an RBAC Group's ID (prefixed `rbac_group_`) for that group's own setting. Writing the `organization` target stops the Plugin from inheriting its marketplace's default, even when the value written equals that default. - `installationPreference: InstallationPreference` The installation setting the target is to hold for this Plugin: one of `required`, `auto_install`, `available`, `not_available`. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class BetaPluginInstallationSetting` - `"plugin_installation_setting" type` Always `plugin_installation_setting`. - `\Datetime createdAt` When the target was first given a setting for this Plugin. - `InstallationPreference installationPreference` The setting the target holds for this Plugin. One of `required`, `auto_install`, `available`, `not_available`; a value this API does not yet name is returned as stored. - `string pluginID` The Plugin's ID. - `Target target` Whose setting this is: `organization` (the Plugin's own organization-wide setting) or `rbac_group` (one RBAC Group's own setting); `organization_member` does not occur here. - `\Datetime updatedAt` When its setting last changed. #### Example ```php beta ->organization ->plugins ->installationSettings ->set( 'target', pluginID: 'plugin_id', installationPreference: 'required', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaPluginInstallationSetting); ``` ##### Response (200) ```json { "created_at": "2026-03-14T09:26:53.589793Z", "installation_preference": "required", "plugin_id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "target": { "type": "organization" }, "type": "plugin_installation_setting", "updated_at": "2026-03-14T09:26:53.589793Z" } ``` ### Remove Plugin Installation Setting `$client->beta->organization->plugins->installationSettings->remove(string target, string pluginID, ?list betas): BetaDeletedPluginInstallationSetting` **DELETE** `/v1/organizations/plugins/{plugin_id}/installation_settings/{target}` Remove an organization-owned Plugin's own installation setting for the whole organization or for one RBAC Group. Removing the `organization` target returns the Plugin to its marketplace's default installation setting and leaves the groups' settings in place. Removing a group's setting makes the group's members fall back to the Plugin's organization-wide setting or to the settings of their other groups. A target that holds no setting of its own returns 404 (a Plugin that already inherits its marketplace's default holds no `organization` setting), and so does a member-owned Plugin. A removal counts as one of the Plugin's installation-setting writes: send all of those writes one at a time. If several arrive for the same Plugin at the same time, the server handles them one after another and can answer some of them with `503` and `x-should-retry: true` instead of applying them; wait a second or two and send the removal again. A `404` on the repeat means the setting is already gone. **Accepted credentials:** an Admin API key with the `write:plugins` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `target: string` (path parameter) The target whose own setting is removed: the literal `organization` for the Plugin's organization-wide setting, or an RBAC Group's ID (prefixed `rbac_group_`) for that group's own setting. Removing the `organization` setting returns the Plugin to its marketplace's default. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class BetaDeletedPluginInstallationSetting` - `"plugin_installation_setting_deleted" type` Always `plugin_installation_setting_deleted`. - `string pluginID` The Plugin's ID. - `Target target` Whose setting was removed. #### Example ```php beta ->organization ->plugins ->installationSettings ->remove( 'target', pluginID: 'plugin_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaDeletedPluginInstallationSetting); ``` ##### Response (200) ```json { "plugin_id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "target": { "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF", "type": "rbac_group" }, "type": "plugin_installation_setting_deleted" } ``` ## Organization › Plugins › Shares ### List Plugin Shares `$client->beta->organization->plugins->shares->list(string pluginID, ?int limit, ?string organizationID, ?string page, ?TargetType targetType, ?list betas): PageCursor` **GET** `/v1/organizations/plugins/{plugin_id}/shares` List the shares the owner of a member-owned Plugin has given — to every member of the organization, to an RBAC Group, or to one member — most recently granted first. Shares are read-only in this API: members give and withdraw them in claude.ai, and who gave a share is recorded on the Compliance API activity feed rather than on the share. An organization-owned Plugin has installation settings instead, so this path returns 404 for one. **Accepted credentials:** an Admin API key with the `read:plugins` or `read:org_audit` scope, or a Compliance Access Key with the `read:compliance_org_data` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `pluginID: string` (path parameter) ID of the Plugin (prefixed `plugin_`). - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `100`. default: 20 - `organizationID?:optional string` (query parameter) For a `read:org_audit` or `read:compliance_org_data` key created for all of a parent organization's linked organizations: a child organization of that parent to read instead of the organization the key was created in, given as the organization's UUID or its `org_`-prefixed ID. A value that is neither returns a 400; an organization that is not a child of the key's parent, or where the Plugins API is not available, returns a 404. Any other key may pass only its own organization's ID here; another organization returns a 404. - `page?:optional string` (query parameter) Optionally set to the `next_page` token from the previous response. - `targetType?:optional TargetType` (query parameter) Only shares with this kind of target: `organization` (every member), `rbac_group` (one RBAC Group), or `organization_member` (one member). - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class BetaPluginShare` - `"plugin_share" type` Always `plugin_share`. - `\Datetime grantedAt` When the share was given; a share whose role is later changed in claude.ai is re-granted and carries the time of that change. - `string pluginID` The Plugin's ID. - `Target target` Who the Plugin is shared with: `organization` (every member), `rbac_group` (one RBAC Group), or `organization_member` (one member). #### Example ```php beta->organization->plugins->shares->list( 'plugin_id', limit: 1, organizationID: 'organization_id', page: 'page', targetType: 'organization', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "granted_at": "2026-03-14T09:26:53.589793Z", "plugin_id": "plugin_01JyHfbRkZvD1gW7oTqXc3Ne", "target": { "type": "organization" }, "type": "plugin_share" } ], "next_page": "page_MjAyNi0wOS0xNlQxNDowNTowOVo" } ``` ## Organization › Plugin Marketplaces ### List Plugin Marketplaces `$client->beta->organization->pluginMarketplaces->list(?int limit, ?string organizationID, ?OwnerType ownerType, ?string page, ?Source source, ?list betas): PageCursor` **GET** `/v1/organizations/plugin_marketplaces` List the plugin marketplaces Plugins live in, newest first: the organization's own and its members' personal ones. Plugin marketplaces are created, connected to a repository and deleted in claude.ai, not through this API. The organization's library marketplace, the organization-owned `manual` marketplace that uploads go to when no marketplace is named, is created the first time something is put in it and is listed from then on. **Accepted credentials:** an Admin API key with the `read:plugins` or `read:org_audit` scope, or a Compliance Access Key with the `read:compliance_org_data` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `limit?:optional int` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. default: 20 - `organizationID?:optional string` (query parameter) For a `read:org_audit` or `read:compliance_org_data` key created for all of a parent organization's linked organizations: a child organization of that parent to read instead of the organization the key was created in, given as the organization's UUID or its `org_`-prefixed ID. A value that is neither returns a 400; an organization that is not a child of the key's parent, or where the Plugins API is not available, returns a 404. Any other key may pass only its own organization's ID here; another organization returns a 404. - `ownerType?:optional OwnerType` (query parameter) `organization` for the organization's plugin marketplaces, `user` for members' personal plugin marketplaces. - `page?:optional string` (query parameter) Optionally set to the `next_page` token from the previous response. - `source?:optional Source` (query parameter) Only plugin marketplaces with this `source`: `manual` for those whose Plugins are uploaded; `github`, `gitlab` or `public_git` for those synchronized from a Git repository. `directory` (Anthropic's catalog) is never listed here. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class PluginMarketplace` - `"plugin_marketplace" type` Always `plugin_marketplace`. - `string id` The plugin marketplace's ID, prefixed `marketplace_`. - `\Datetime createdAt` RFC 3339. - `?DefaultInstallationPreference defaultInstallationPreference` Organization plugin marketplace: the organization-wide setting every Plugin in it with no setting of its own gets. Null for a member's personal plugin marketplace. One of `required`, `auto_install`, `available`, `not_available`; a value this API does not yet name is returned as stored. - `?\Datetime lastSyncEndedAt` RFC 3339. When the most recent synchronization attempt to finish did so, whatever its outcome; for a repository plugin marketplace no synchronization has run on yet, when it was created. Null for a plugin marketplace that is not synchronized from a repository. - `?string lastSyncReadSha` The commit the last synchronization attempt that reached the repository read, whether or not its content was then accepted (see `sync_status`); an attempt that ends `failed_auth` or `failed_transient` leaves it unchanged. Null until an attempt has first read the repository, and for a plugin marketplace that is not synchronized from a repository. - `string name` Fixed for the plugin marketplace's lifetime. - `Owner owner` The organization, or the member whose personal plugin marketplace it is. - `Source source` Where the plugin marketplace's Plugins come from: `manual` when they are uploaded; `github`, `gitlab` or `public_git` when they are synchronized from the Git repository the owner connected, into which nothing can be uploaded; `directory` is Anthropic's own catalog, which this API does not list. A value this API does not yet name is returned as stored. - `?SyncStatus syncStatus` Outcome of the plugin marketplace's most recent synchronization: one of `success`, `in_progress`, `failed_content`, `failed_transient`, `failed_auth`, `failed_limits`; a value this API does not yet name is returned as stored. Null until a synchronization is first attempted — so always for a `manual` plugin marketplace. #### Example ```php beta->organization->pluginMarketplaces->list( limit: 1, organizationID: 'organization_id', ownerType: 'organization', page: 'page', source: 'directory', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "marketplace_01HxQ3v9KpZ2mTn8RwLc4Ys7", "created_at": "2026-03-14T09:26:53.589793Z", "default_installation_preference": "available", "last_sync_ended_at": "2026-03-14T09:26:53.589793Z", "last_sync_read_sha": "9fceb02d0ae598e95dc970b74767f19372d61af8", "name": "engineering-tools", "owner": { "type": "organization" }, "source": "github", "sync_status": "success", "type": "plugin_marketplace" } ], "next_page": "page_MjAyNi0wOS0xNlQxNDowNTowOVo" } ``` ### Get Plugin Marketplace `$client->beta->organization->pluginMarketplaces->retrieve(string marketplaceID, ?string organizationID, ?list betas): PluginMarketplace` **GET** `/v1/organizations/plugin_marketplaces/{marketplace_id}` Retrieve a plugin marketplace by ID. **Accepted credentials:** an Admin API key with the `read:plugins` or `read:org_audit` scope, or a Compliance Access Key with the `read:compliance_org_data` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `marketplaceID: string` (path parameter) ID of the plugin marketplace (prefixed `marketplace_`). - `organizationID?:optional string` (query parameter) For a `read:org_audit` or `read:compliance_org_data` key created for all of a parent organization's linked organizations: a child organization of that parent to read instead of the organization the key was created in, given as the organization's UUID or its `org_`-prefixed ID. A value that is neither returns a 400; an organization that is not a child of the key's parent, or where the Plugins API is not available, returns a 404. Any other key may pass only its own organization's ID here; another organization returns a 404. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class PluginMarketplace` - `"plugin_marketplace" type` Always `plugin_marketplace`. - `string id` The plugin marketplace's ID, prefixed `marketplace_`. - `\Datetime createdAt` RFC 3339. - `?DefaultInstallationPreference defaultInstallationPreference` Organization plugin marketplace: the organization-wide setting every Plugin in it with no setting of its own gets. Null for a member's personal plugin marketplace. One of `required`, `auto_install`, `available`, `not_available`; a value this API does not yet name is returned as stored. - `?\Datetime lastSyncEndedAt` RFC 3339. When the most recent synchronization attempt to finish did so, whatever its outcome; for a repository plugin marketplace no synchronization has run on yet, when it was created. Null for a plugin marketplace that is not synchronized from a repository. - `?string lastSyncReadSha` The commit the last synchronization attempt that reached the repository read, whether or not its content was then accepted (see `sync_status`); an attempt that ends `failed_auth` or `failed_transient` leaves it unchanged. Null until an attempt has first read the repository, and for a plugin marketplace that is not synchronized from a repository. - `string name` Fixed for the plugin marketplace's lifetime. - `Owner owner` The organization, or the member whose personal plugin marketplace it is. - `Source source` Where the plugin marketplace's Plugins come from: `manual` when they are uploaded; `github`, `gitlab` or `public_git` when they are synchronized from the Git repository the owner connected, into which nothing can be uploaded; `directory` is Anthropic's own catalog, which this API does not list. A value this API does not yet name is returned as stored. - `?SyncStatus syncStatus` Outcome of the plugin marketplace's most recent synchronization: one of `success`, `in_progress`, `failed_content`, `failed_transient`, `failed_auth`, `failed_limits`; a value this API does not yet name is returned as stored. Null until a synchronization is first attempted — so always for a `manual` plugin marketplace. #### Example ```php beta ->organization ->pluginMarketplaces ->retrieve( 'marketplace_id', organizationID: 'organization_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaPluginMarketplace); ``` ##### Response (200) ```json { "id": "marketplace_01HxQ3v9KpZ2mTn8RwLc4Ys7", "created_at": "2026-03-14T09:26:53.589793Z", "default_installation_preference": "available", "last_sync_ended_at": "2026-03-14T09:26:53.589793Z", "last_sync_read_sha": "9fceb02d0ae598e95dc970b74767f19372d61af8", "name": "engineering-tools", "owner": { "type": "organization" }, "source": "github", "sync_status": "success", "type": "plugin_marketplace" } ``` ### Update Plugin Marketplace `$client->beta->organization->pluginMarketplaces->update(string marketplaceID, DefaultInstallationPreference defaultInstallationPreference, ?list betas): PluginMarketplace` **POST** `/v1/organizations/plugin_marketplaces/{marketplace_id}` Set the default installation setting of one of the organization's own plugin marketplaces. Every Plugin in it without a setting of its own gets this default as its organization-wide setting, including Plugins added later. Pass it as `default_installation_preference`. A member's personal marketplace cannot be updated here (403). **Accepted credentials:** an Admin API key with the `write:plugins` scope. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `marketplaceID: string` (path parameter) ID of the plugin marketplace (prefixed `marketplace_`). - `defaultInstallationPreference: DefaultInstallationPreference` The organization-wide installation setting every Plugin in the marketplace without one of its own gets: one of `required`, `auto_install`, `available`, `not_available`. Once set it can be changed but not removed. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class PluginMarketplace` - `"plugin_marketplace" type` Always `plugin_marketplace`. - `string id` The plugin marketplace's ID, prefixed `marketplace_`. - `\Datetime createdAt` RFC 3339. - `?DefaultInstallationPreference defaultInstallationPreference` Organization plugin marketplace: the organization-wide setting every Plugin in it with no setting of its own gets. Null for a member's personal plugin marketplace. One of `required`, `auto_install`, `available`, `not_available`; a value this API does not yet name is returned as stored. - `?\Datetime lastSyncEndedAt` RFC 3339. When the most recent synchronization attempt to finish did so, whatever its outcome; for a repository plugin marketplace no synchronization has run on yet, when it was created. Null for a plugin marketplace that is not synchronized from a repository. - `?string lastSyncReadSha` The commit the last synchronization attempt that reached the repository read, whether or not its content was then accepted (see `sync_status`); an attempt that ends `failed_auth` or `failed_transient` leaves it unchanged. Null until an attempt has first read the repository, and for a plugin marketplace that is not synchronized from a repository. - `string name` Fixed for the plugin marketplace's lifetime. - `Owner owner` The organization, or the member whose personal plugin marketplace it is. - `Source source` Where the plugin marketplace's Plugins come from: `manual` when they are uploaded; `github`, `gitlab` or `public_git` when they are synchronized from the Git repository the owner connected, into which nothing can be uploaded; `directory` is Anthropic's own catalog, which this API does not list. A value this API does not yet name is returned as stored. - `?SyncStatus syncStatus` Outcome of the plugin marketplace's most recent synchronization: one of `success`, `in_progress`, `failed_content`, `failed_transient`, `failed_auth`, `failed_limits`; a value this API does not yet name is returned as stored. Null until a synchronization is first attempted — so always for a `manual` plugin marketplace. #### Example ```php beta ->organization ->pluginMarketplaces ->update( 'marketplace_id', defaultInstallationPreference: 'available', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaPluginMarketplace); ``` ##### Response (200) ```json { "id": "marketplace_01HxQ3v9KpZ2mTn8RwLc4Ys7", "created_at": "2026-03-14T09:26:53.589793Z", "default_installation_preference": "available", "last_sync_ended_at": "2026-03-14T09:26:53.589793Z", "last_sync_read_sha": "9fceb02d0ae598e95dc970b74767f19372d61af8", "name": "engineering-tools", "owner": { "type": "organization" }, "source": "github", "sync_status": "success", "type": "plugin_marketplace" } ``` ### Validate Plugin Marketplace Repository `$client->beta->organization->pluginMarketplaces->validateRepository(string repositoryURL, ?string ref, ?list betas): PluginMarketplaceValidationReport` **POST** `/v1/organizations/plugin_marketplaces/validate_repository` Check whether a plugin marketplace held in a public GitHub repository would synchronize into claude.ai, without connecting or storing it. To check a `.zip` of the marketplace directory instead, use Validate Plugin Marketplace Archive. The report says whether `marketplace.json` is well-formed, which plugins a synchronization would skip and why, and which plugins would synchronize only in part, with some files left out. A repository that is missing, private, or has no such branch or commit is reported, not refused: the response is a report with `valid: false`. Plugin sources outside the marketplace are fetched anonymously from GitHub, so a private one is reported as not found or as needing a GitHub sign-in; a source on any other host is not fetched here, and the report notes that it will be checked when the marketplace actually synchronizes. Nothing is recorded on the Compliance API activity feed. For a worked example, see [Validate marketplace content](https://platform.claude.com/docs/en/manage-claude/plugins-api?sdk_languages=php#validate-marketplace-content) in the Plugins API guide. **Accepted credentials:** an Admin API key with the `read:plugins` or `write:plugins` scope; `read:org_audit` and `read:compliance_org_data` do not grant it. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `repositoryURL: string` The `https://` URL of a public repository on github.com that holds the marketplace. A URL longer than 2,048 characters, on any other host or scheme, with a port other than 443 or 80, with credentials in it, or that does not name exactly `owner/repo` (a trailing `.git` or `/` is accepted) is a 400. A private or missing repository is reported in the response, not refused. - `ref?:optional string` The branch to validate the tip of, or the full 40-character SHA of the commit to validate. When omitted, the branch a synchronization would read (usually the repository's default branch); if that is not the default branch, the report's `ref` says which branch was read. An empty string, a value longer than 255 characters, or one that contains `..` or a character other than ASCII letters, digits, `.`, `_`, `-`, `+`, and `/`, is a 400. Any other value that is not a 40-character SHA is read as a branch name; if the repository has no such branch, the response is a report with `valid: false`, not a 400. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class PluginMarketplaceValidationReport` - `"plugin_marketplace_validation_report" type` Always `plugin_marketplace_validation_report`. - `?string commitSha` The full SHA of the commit that was validated: for a repository, the commit that was read; for an uploaded archive, the commit recorded in the archive's comment (as a Git host's download writes it; not verified), else null. - `?string manifestError` Set when nothing could be validated: the repository or archive could not be read, or marketplace.json is missing, malformed or over a limit. Null otherwise. - `?string manifestErrorCode` A stable identifier for `manifest_error`; null when that is. - `list pluginErrors` One entry per plugin a synchronization would skip entirely, keyed by the plugin's name in marketplace.json. - `list pluginWarnings` One entry per plugin that would synchronize with some of its contents left out, keyed by the plugin's name in marketplace.json. - `?string ref` For a repository, the branch that was read by name: the one requested, or else the branch a synchronization of this repository is set to read. Null when no branch is named or set and the repository's default branch was read, for a request by commit SHA, and for an uploaded archive. - `int totalPluginCount` How many plugins marketplace.json declares; 0 when it could not be read. - `bool valid` True when marketplace.json is well-formed and no plugin would be skipped; warnings never make it false. #### Example ```php beta ->organization ->pluginMarketplaces ->validateRepository( repositoryURL: 'https://github.com/example-org/example-marketplace', ref: 'main', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaPluginMarketplaceValidationReport); ``` ##### Response (200) ```json { "commit_sha": "9fceb02d0ae598e95dc970b74767f19372d61af8", "manifest_error": "manifest_error", "manifest_error_code": "marketplace_sync_manifest_not_found", "plugin_errors": [ { "error": "error", "error_code": "marketplace_sync_plugin_missing_manifest", "name": "name" } ], "plugin_warnings": [ { "name": "name", "warnings": [ { "error_code": "marketplace_sync_zipball_symlink_dangling", "message": "message" } ] } ], "ref": "main", "total_plugin_count": 0, "type": "plugin_marketplace_validation_report", "valid": false } ``` ### Validate Plugin Marketplace Archive `$client->beta->organization->pluginMarketplaces->validateArchive(FileParam | string archive, ?list betas): PluginMarketplaceValidationReport` **POST** `/v1/organizations/plugin_marketplaces/validate_archive` Check whether a plugin marketplace, uploaded as a `.zip` of the marketplace directory, would synchronize into claude.ai, without connecting or storing it. To check a public GitHub repository instead, use Validate Plugin Marketplace Repository. The report says whether `marketplace.json` is well-formed, which plugins a synchronization would skip and why, and which plugins would synchronize only in part, with some files left out. An archive that cannot be read as a marketplace is reported, not refused: the response is a report with `valid: false`. Plugin sources outside the marketplace are fetched anonymously from GitHub, so a private one is reported as not found or as needing a GitHub sign-in; a source on any other host is not fetched here, and the report notes that it will be checked when the marketplace actually synchronizes. Nothing is recorded on the Compliance API activity feed. For a worked example, see [Validate marketplace content](https://platform.claude.com/docs/en/manage-claude/plugins-api?sdk_languages=php#validate-marketplace-content) in the Plugins API guide. **Accepted credentials:** an Admin API key with the `read:plugins` or `write:plugins` scope; `read:org_audit` and `read:compliance_org_data` do not grant it. Every request must include the beta header `anthropic-beta: ce-plugins-2026-09-01`. A request without it returns `404`, exactly as if the endpoint did not exist. The Plugins API is in beta and is available to Claude Enterprise organizations only. It is not available to Claude Platform (Claude Console) organizations, or to organizations with HIPAA readiness enabled. #### Parameters - `archive: FileParam | string` A .zip of the marketplace directory (its contents at the root, or wrapped in one folder as a Git host's download produces), sent as a file part with a filename; DEFLATE- or STORE-compressed, at most 32 MB. A part sent without a filename, a second archive part, or any other form field is a 400; a larger archive is a 413. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `ce-plugins-2026-09-01` in this header. #### Returns - `class PluginMarketplaceValidationReport` - `"plugin_marketplace_validation_report" type` Always `plugin_marketplace_validation_report`. - `?string commitSha` The full SHA of the commit that was validated: for a repository, the commit that was read; for an uploaded archive, the commit recorded in the archive's comment (as a Git host's download writes it; not verified), else null. - `?string manifestError` Set when nothing could be validated: the repository or archive could not be read, or marketplace.json is missing, malformed or over a limit. Null otherwise. - `?string manifestErrorCode` A stable identifier for `manifest_error`; null when that is. - `list pluginErrors` One entry per plugin a synchronization would skip entirely, keyed by the plugin's name in marketplace.json. - `list pluginWarnings` One entry per plugin that would synchronize with some of its contents left out, keyed by the plugin's name in marketplace.json. - `?string ref` For a repository, the branch that was read by name: the one requested, or else the branch a synchronization of this repository is set to read. Null when no branch is named or set and the repository's default branch was read, for a request by commit SHA, and for an uploaded archive. - `int totalPluginCount` How many plugins marketplace.json declares; 0 when it could not be read. - `bool valid` True when marketplace.json is well-formed and no plugin would be skipped; warnings never make it false. #### Example ```php beta ->organization ->pluginMarketplaces ->validateArchive( archive: FileParam::fromString('Example data', filename: uniqid('file-upload-', true)), betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaPluginMarketplaceValidationReport); ``` ##### Response (200) ```json { "commit_sha": "9fceb02d0ae598e95dc970b74767f19372d61af8", "manifest_error": "manifest_error", "manifest_error_code": "marketplace_sync_manifest_not_found", "plugin_errors": [ { "error": "error", "error_code": "marketplace_sync_plugin_missing_manifest", "name": "name" } ], "plugin_warnings": [ { "name": "name", "warnings": [ { "error_code": "marketplace_sync_zipball_symlink_dangling", "message": "message" } ] } ], "ref": "main", "total_plugin_count": 0, "type": "plugin_marketplace_validation_report", "valid": false } ``` ## Organization › Telemetry Destinations ### Create a Telemetry Destination `$client->beta->organization->telemetryDestinations->create(string endpointURL, TelemetryDestinationWorkspacesParams workspaces, ?string displayName, ?array headers, ?TelemetryDestinationTracesParams traces, ?list betas): TelemetryDestination` **POST** `/v1/organizations/telemetry_destinations` Register an OpenTelemetry destination for the organization. The destination starts in state `enabled`. An organization can have at most 10 destinations, including disabled ones. See the [OpenTelemetry export guide](https://platform.claude.com/docs/en/manage-claude/opentelemetry?sdk_languages=php#add-a-destination) to learn more about adding a destination. #### Parameters - `endpointURL: string` The base URL of your collector's OTLP/HTTP endpoint, for example `https://gateway.example.com`. The URL must use `https` and a hostname, not an IP address. The port, if given, must be 443. The URL must not contain a query string, a fragment, or a username and password. At most 2,048 characters. A path prefix, such as `/otlp`, is allowed. Don't include the per-signal path (`/v1/traces`), because the API appends it on delivery. If your collector takes traces on another path, also set `traces.endpoint_url`. - `workspaces: TelemetryDestinationWorkspacesParams` Which of the organization's workspaces the destination covers. - `displayName?:optional string` Human-readable name for the destination. Optional. 1 to 255 characters. - `headers?:optional array` Request headers that the API sends with every delivery, typically your collector's authentication header (for example `authorization`). The API stores the values encrypted and never returns them. Reads show only `header_names`. At most 20 headers. Names are at most 128 characters. Two names can't differ only in case. Values are printable ASCII, at most 4,096 characters, and can't begin or end with a space. Names and values together are at most 16,384 bytes. Reserved names are rejected, for example `host`, `cookie`, `user-agent`, and names that start with `content-`, `proxy-`, `x-forwarded-`, or `anthropic-`. For this check, `_` in a name counts as `-`. - `traces?:optional TelemetryDestinationTracesParams` The settings for the traces that the destination receives. If you leave it out, every setting takes its default. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `telemetry-destinations-2026-08-11` in this header. #### Returns - `class TelemetryDestination` - `"telemetry_destination" type` - `string id` The unique ID of the destination (`tdst_...`). - `\Datetime createdAt` Time the destination was created. - `TelemetryDestinationDeliveryHealth deliveryHealth` The most recent delivery results for this destination. - `?string displayName` Human-readable name for the destination. Null when none was set. - `string endpointURL` The base URL of the destination's OTLP/HTTP endpoint, exactly as registered. The API appends the per-signal path, such as `/v1/traces`, on delivery, unless `traces.endpoint_url` is set. - `list headerNames` Names of the registered request headers. Header values are write-only and are never returned. - `TelemetryDestinationState state` Whether the destination receives deliveries. - `TelemetryDestinationTraces traces` The destination's settings for the traces it receives. - `\Datetime updatedAt` Time of the last change to the destination's configuration or state. Changes to `delivery_health` don't change it. An update that sets a header value always changes it, even when the value is the same as before. Adding or removing a single workspace on the destination's list doesn't change it. An update that changes the list does. - `TelemetryDestinationWorkspaces workspaces` Which of the organization's workspaces the destination covers. #### Example ```php beta ->organization ->telemetryDestinations ->create( endpointURL: 'x', workspaces: ['type' => 'all'], displayName: 'display_name', headers: ['foo' => 'string'], traces: [ 'contentMode' => TelemetryDestinationContentMode::METADATA_ONLY, 'enabled' => true, 'endpointURL' => 'endpoint_url', 'maxContentBytes' => 0, ], betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaTelemetryDestination); ``` ##### Response (200) ```json { "id": "id", "created_at": "2019-12-27T18:11:19.117Z", "delivery_health": { "last_error": "last_error", "last_error_at": "2019-12-27T18:11:19.117Z", "last_success_at": "2019-12-27T18:11:19.117Z" }, "display_name": "display_name", "endpoint_url": "endpoint_url", "header_names": [ "string" ], "state": { "type": "enabled" }, "traces": { "content_mode": "metadata_only", "enabled": true, "endpoint_url": "endpoint_url", "max_content_bytes": 0 }, "type": "telemetry_destination", "updated_at": "2019-12-27T18:11:19.117Z", "workspaces": { "type": "all" } } ``` ### List Telemetry Destinations `$client->beta->organization->telemetryDestinations->list(?int limit, ?string page, ?list workspaceIDs, ?list betas): PageCursor` **GET** `/v1/organizations/telemetry_destinations` List the organization's destinations, newest first, optionally only those that cover given workspaces. See the [OpenTelemetry export guide](https://platform.claude.com/docs/en/manage-claude/opentelemetry?sdk_languages=php#set-up-api-tracing) to learn more about destinations. #### Parameters - `limit?:optional int` (query parameter) Number of destinations to return per page, between 1 and 1,000. Defaults to 20. - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page`. Leave it out to get the first page. - `workspaceIDs?:optional list` (query parameter) Return only the destinations that cover at least one of these workspaces (`wrkspc_...`). Send at most 100 IDs, as `workspace_ids[]`. A destination covers a workspace when its `workspaces.type` is `all`, when its `include` list has the workspace, or when its `exclude` list doesn't have it. Destinations in either state can match. An ID that isn't the ID of one of the organization's workspaces doesn't match any destination, not even one whose type is `all`. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `telemetry-destinations-2026-08-11` in this header. #### Returns - `class TelemetryDestination` - `"telemetry_destination" type` - `string id` The unique ID of the destination (`tdst_...`). - `\Datetime createdAt` Time the destination was created. - `TelemetryDestinationDeliveryHealth deliveryHealth` The most recent delivery results for this destination. - `?string displayName` Human-readable name for the destination. Null when none was set. - `string endpointURL` The base URL of the destination's OTLP/HTTP endpoint, exactly as registered. The API appends the per-signal path, such as `/v1/traces`, on delivery, unless `traces.endpoint_url` is set. - `list headerNames` Names of the registered request headers. Header values are write-only and are never returned. - `TelemetryDestinationState state` Whether the destination receives deliveries. - `TelemetryDestinationTraces traces` The destination's settings for the traces it receives. - `\Datetime updatedAt` Time of the last change to the destination's configuration or state. Changes to `delivery_health` don't change it. An update that sets a header value always changes it, even when the value is the same as before. Adding or removing a single workspace on the destination's list doesn't change it. An update that changes the list does. - `TelemetryDestinationWorkspaces workspaces` Which of the organization's workspaces the destination covers. #### Example ```php beta->organization->telemetryDestinations->list( limit: 0, page: 'page', workspaceIDs: ['string'], betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "id", "created_at": "2019-12-27T18:11:19.117Z", "delivery_health": { "last_error": "last_error", "last_error_at": "2019-12-27T18:11:19.117Z", "last_success_at": "2019-12-27T18:11:19.117Z" }, "display_name": "display_name", "endpoint_url": "endpoint_url", "header_names": [ "string" ], "state": { "type": "enabled" }, "traces": { "content_mode": "metadata_only", "enabled": true, "endpoint_url": "endpoint_url", "max_content_bytes": 0 }, "type": "telemetry_destination", "updated_at": "2019-12-27T18:11:19.117Z", "workspaces": { "type": "all" } } ], "next_page": "next_page" } ``` ### Retrieve a Telemetry Destination `$client->beta->organization->telemetryDestinations->retrieve(string destinationID, ?list betas): TelemetryDestination` **GET** `/v1/organizations/telemetry_destinations/{destination_id}` Read a destination's configuration, state, and most recent delivery results. See the [OpenTelemetry export guide](https://platform.claude.com/docs/en/manage-claude/opentelemetry?sdk_languages=php#delivery-and-health) to learn how the API delivers spans and when it disables a destination. #### Parameters - `destinationID: string` (path parameter) ID of the destination (`tdst_...`). - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `telemetry-destinations-2026-08-11` in this header. #### Returns - `class TelemetryDestination` - `"telemetry_destination" type` - `string id` The unique ID of the destination (`tdst_...`). - `\Datetime createdAt` Time the destination was created. - `TelemetryDestinationDeliveryHealth deliveryHealth` The most recent delivery results for this destination. - `?string displayName` Human-readable name for the destination. Null when none was set. - `string endpointURL` The base URL of the destination's OTLP/HTTP endpoint, exactly as registered. The API appends the per-signal path, such as `/v1/traces`, on delivery, unless `traces.endpoint_url` is set. - `list headerNames` Names of the registered request headers. Header values are write-only and are never returned. - `TelemetryDestinationState state` Whether the destination receives deliveries. - `TelemetryDestinationTraces traces` The destination's settings for the traces it receives. - `\Datetime updatedAt` Time of the last change to the destination's configuration or state. Changes to `delivery_health` don't change it. An update that sets a header value always changes it, even when the value is the same as before. Adding or removing a single workspace on the destination's list doesn't change it. An update that changes the list does. - `TelemetryDestinationWorkspaces workspaces` Which of the organization's workspaces the destination covers. #### Example ```php beta ->organization ->telemetryDestinations ->retrieve( 'destination_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24] ); var_dump($betaTelemetryDestination); ``` ##### Response (200) ```json { "id": "id", "created_at": "2019-12-27T18:11:19.117Z", "delivery_health": { "last_error": "last_error", "last_error_at": "2019-12-27T18:11:19.117Z", "last_success_at": "2019-12-27T18:11:19.117Z" }, "display_name": "display_name", "endpoint_url": "endpoint_url", "header_names": [ "string" ], "state": { "type": "enabled" }, "traces": { "content_mode": "metadata_only", "enabled": true, "endpoint_url": "endpoint_url", "max_content_bytes": 0 }, "type": "telemetry_destination", "updated_at": "2019-12-27T18:11:19.117Z", "workspaces": { "type": "all" } } ``` ### Update a Telemetry Destination `$client->beta->organization->telemetryDestinations->update(string destinationID, ?string displayName, ?string endpointURL, ?array headers, ?TelemetryDestinationStateParams state, ?TelemetryDestinationTracesParams traces, ?TelemetryDestinationWorkspacesParams workspaces, ?list betas): TelemetryDestination` **POST** `/v1/organizations/telemetry_destinations/{destination_id}` Change a telemetry destination's settings, its state, or which workspaces it covers. Send at least one field. Omitted fields keep their stored values, except the registered headers, which a change of the endpoint's hostname or port removes. Only `display_name`, `traces`, `traces.endpoint_url`, `traces.content_mode`, `traces.max_content_bytes`, and individual `headers` values accept `null`. If another request changes the destination while the update runs, the API returns a 409 `conflict_error`. Read the destination again, then retry the update. See the [OpenTelemetry export guide](https://platform.claude.com/docs/en/manage-claude/opentelemetry?sdk_languages=php#delivery-and-health) to learn more about changing a destination. #### Parameters - `destinationID: string` (path parameter) ID of the destination (`tdst_...`). - `displayName?:optional string` New human-readable name, 1 to 255 characters. Null clears it. - `endpointURL?:optional string` The new base URL of the destination's OTLP/HTTP endpoint. The same rules as on create apply. A change of hostname or port first removes every registered header, so send the headers for the new endpoint in the same request. When the destination has a `traces.endpoint_url`, such a change must also set `traces.endpoint_url` to a URL with the new hostname and port, or to `null`. A change of the path alone keeps the headers. - `headers?:optional array` Headers to set or remove. The API merges them into the destination's headers by name. Names compare case-insensitively. A string value sets or replaces that header. A `null` value removes it. Headers that you omit don't change. The field itself can't be `null`. A request that sets a header value must also include `endpoint_url`. The current URL is accepted. The resulting set must stay within the same limits as on create. When the request sets a value, each stored value that it doesn't set counts as 4,096 bytes toward the 16,384-byte limit, because you can't read its real length. So to change one header of a destination that has four or more other headers, send the values of the others again in the same request. - `state?:optional TelemetryDestinationStateParams` Whether the destination receives deliveries after the update. The field can't be `null`. - `traces?:optional TelemetryDestinationTracesParams` The traces settings to change. Omitted settings keep their stored values. `null` sets every traces setting to its create default. - `workspaces?:optional TelemetryDestinationWorkspacesParams` The new workspace scope, in the same form as on create. The field can't be `null`. The API refuses an update that changes the type or sends `workspace_ids` while the destination's list has more than 750 workspaces. Remove workspaces one at a time until 750 or fewer remain, then send the update again. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `telemetry-destinations-2026-08-11` in this header. #### Returns - `class TelemetryDestination` - `"telemetry_destination" type` - `string id` The unique ID of the destination (`tdst_...`). - `\Datetime createdAt` Time the destination was created. - `TelemetryDestinationDeliveryHealth deliveryHealth` The most recent delivery results for this destination. - `?string displayName` Human-readable name for the destination. Null when none was set. - `string endpointURL` The base URL of the destination's OTLP/HTTP endpoint, exactly as registered. The API appends the per-signal path, such as `/v1/traces`, on delivery, unless `traces.endpoint_url` is set. - `list headerNames` Names of the registered request headers. Header values are write-only and are never returned. - `TelemetryDestinationState state` Whether the destination receives deliveries. - `TelemetryDestinationTraces traces` The destination's settings for the traces it receives. - `\Datetime updatedAt` Time of the last change to the destination's configuration or state. Changes to `delivery_health` don't change it. An update that sets a header value always changes it, even when the value is the same as before. Adding or removing a single workspace on the destination's list doesn't change it. An update that changes the list does. - `TelemetryDestinationWorkspaces workspaces` Which of the organization's workspaces the destination covers. #### Example ```php beta ->organization ->telemetryDestinations ->update( 'destination_id', displayName: 'display_name', endpointURL: 'endpoint_url', headers: ['foo' => 'string'], state: ['type' => 'enabled'], traces: [ 'contentMode' => TelemetryDestinationContentMode::METADATA_ONLY, 'enabled' => true, 'endpointURL' => 'endpoint_url', 'maxContentBytes' => 0, ], workspaces: ['type' => 'all'], betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaTelemetryDestination); ``` ##### Response (200) ```json { "id": "id", "created_at": "2019-12-27T18:11:19.117Z", "delivery_health": { "last_error": "last_error", "last_error_at": "2019-12-27T18:11:19.117Z", "last_success_at": "2019-12-27T18:11:19.117Z" }, "display_name": "display_name", "endpoint_url": "endpoint_url", "header_names": [ "string" ], "state": { "type": "enabled" }, "traces": { "content_mode": "metadata_only", "enabled": true, "endpoint_url": "endpoint_url", "max_content_bytes": 0 }, "type": "telemetry_destination", "updated_at": "2019-12-27T18:11:19.117Z", "workspaces": { "type": "all" } } ``` ### Delete a Telemetry Destination `$client->beta->organization->telemetryDestinations->delete(string destinationID, ?list betas): DeletedTelemetryDestination` **DELETE** `/v1/organizations/telemetry_destinations/{destination_id}` Delete a destination and its workspace list. The API stops sending spans to the destination. The spans of the workspaces it covered still go to the other destinations that cover them. A deleted destination can't be read, listed, or restored. See the [OpenTelemetry export guide](https://platform.claude.com/docs/en/manage-claude/opentelemetry?sdk_languages=php#delivery-and-health) to learn more about managing a destination. #### Parameters - `destinationID: string` (path parameter) ID of the destination (`tdst_...`). - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `telemetry-destinations-2026-08-11` in this header. #### Returns - `class DeletedTelemetryDestination` - `"telemetry_destination_deleted" type` - `string id` ID of the deleted destination (`tdst_...`). #### Example ```php beta ->organization ->telemetryDestinations ->delete( 'destination_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24] ); var_dump($betaDeletedTelemetryDestination); ``` ##### Response (200) ```json { "id": "id", "type": "telemetry_destination_deleted" } ``` ### Test a Telemetry Destination `$client->beta->organization->telemetryDestinations->test(string destinationID, ?list betas): TelemetryDestinationTestResponse` **POST** `/v1/organizations/telemetry_destinations/{destination_id}/test` Send one test span, named `anthropic.test`, to the destination with its registered headers, once and without retries, and report the destination's answer. The response is 200 whether or not the destination answered with a 2xx status: its `result` has the type `success`, or the type `failure` and the reason in `error`. The destination's configuration, `state` and `delivery_health` do not change. A disabled destination can be tested too. Wait 10 seconds between tests of one destination; a request that comes sooner may be answered with status 429. #### Parameters - `destinationID: string` (path parameter) ID of the destination to test (starts with `tdst_`). - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `telemetry-destinations-2026-08-11` in this header. #### Returns - `class TelemetryDestinationTestResponse` - `"telemetry_destination_test" type` - `TelemetryDestinationTestResult result` How the test went: `success` when the destination answered with a 2xx status, else `failure` with the reason. #### Example ```php beta ->organization ->telemetryDestinations ->test('destination_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24]); var_dump($betaTelemetryDestinationTestResponse); ``` ##### Response (200) ```json { "result": { "type": "success" }, "type": "telemetry_destination_test" } ``` ## Organization › Telemetry Destinations › Workspaces ### List Telemetry Destination Workspaces `$client->beta->organization->telemetryDestinations->workspaces->list(string destinationID, ?int limit, ?string page, ?list betas): PageCursor` **GET** `/v1/organizations/telemetry_destinations/{destination_id}/workspaces` List the workspaces on a destination's workspace list, newest entry first. A destination whose `workspaces.type` is `all` doesn't have a list, so its page is empty. The list includes archived workspaces. See the [OpenTelemetry export guide](https://platform.claude.com/docs/en/manage-claude/opentelemetry?sdk_languages=php#choose-workspaces-for-a-destination) to learn more about choosing the workspaces of a destination. #### Parameters - `destinationID: string` (path parameter) ID of the destination (`tdst_...`). - `limit?:optional int` (query parameter) Number of entries to return per page, between 1 and 1,000. Defaults to 20. - `page?:optional string` (query parameter) Opaque cursor from a previous response's `next_page`. Leave it out to get the first page. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `telemetry-destinations-2026-08-11` in this header. #### Returns - `class BetaTelemetryDestinationWorkspace` - `"telemetry_destination_workspace" type` - `\Datetime createdAt` Time the workspace was added to the list. - `string telemetryDestinationID` ID of the telemetry destination (`tdst_...`). - `string workspaceID` ID of the workspace (`wrkspc_...`). #### Example ```php beta->organization->telemetryDestinations->workspaces->list( 'destination_id', limit: 0, page: 'page', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "created_at": "2019-12-27T18:11:19.117Z", "telemetry_destination_id": "telemetry_destination_id", "type": "telemetry_destination_workspace", "workspace_id": "workspace_id" } ], "next_page": "next_page" } ``` ### Add a Telemetry Destination Workspace `$client->beta->organization->telemetryDestinations->workspaces->add(string workspaceID, string destinationID, ?list betas): BetaTelemetryDestinationWorkspace` **POST** `/v1/organizations/telemetry_destinations/{destination_id}/workspaces/{workspace_id}` Add one workspace to a destination's workspace list. Under `include` the workspace's spans start going to the destination. Under `exclude` they stop. A list holds at most 1,000 workspaces. Adding a workspace that is already on the list changes nothing and returns the existing entry. An archived workspace that isn't on the list yet can't be added. A destination whose `workspaces.type` is `all` doesn't have a list, so the API returns 400. To change which workspaces such a destination covers, update its `workspaces`. See the [OpenTelemetry export guide](https://platform.claude.com/docs/en/manage-claude/opentelemetry?sdk_languages=php#choose-workspaces-for-a-destination) to learn more about choosing the workspaces of a destination. #### Parameters - `destinationID: string` (path parameter) ID of the destination (`tdst_...`). - `workspaceID: string` (path parameter) ID of the workspace to add (`wrkspc_...`). - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `telemetry-destinations-2026-08-11` in this header. #### Returns - `class BetaTelemetryDestinationWorkspace` - `"telemetry_destination_workspace" type` - `\Datetime createdAt` Time the workspace was added to the list. - `string telemetryDestinationID` ID of the telemetry destination (`tdst_...`). - `string workspaceID` ID of the workspace (`wrkspc_...`). #### Example ```php beta ->organization ->telemetryDestinations ->workspaces ->add( 'workspace_id', destinationID: 'destination_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaTelemetryDestinationWorkspace); ``` ##### Response (200) ```json { "created_at": "2019-12-27T18:11:19.117Z", "telemetry_destination_id": "telemetry_destination_id", "type": "telemetry_destination_workspace", "workspace_id": "workspace_id" } ``` ### Remove a Telemetry Destination Workspace `$client->beta->organization->telemetryDestinations->workspaces->remove(string workspaceID, string destinationID, ?list betas): BetaDeletedTelemetryDestinationWorkspace` **DELETE** `/v1/organizations/telemetry_destinations/{destination_id}/workspaces/{workspace_id}` Remove one workspace from a destination's workspace list. Under `include` the workspace's spans stop going to the destination. Under `exclude` they start. An archived workspace can be removed too. The API returns 404 when the workspace isn't on the list. A destination whose `workspaces.type` is `all` doesn't have a list, so the API returns 400. See the [OpenTelemetry export guide](https://platform.claude.com/docs/en/manage-claude/opentelemetry?sdk_languages=php#choose-workspaces-for-a-destination) to learn more about choosing the workspaces of a destination. #### Parameters - `destinationID: string` (path parameter) ID of the destination (`tdst_...`). - `workspaceID: string` (path parameter) ID of the workspace to remove (`wrkspc_...`). - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `telemetry-destinations-2026-08-11` in this header. #### Returns - `class BetaDeletedTelemetryDestinationWorkspace` - `"telemetry_destination_workspace_deleted" type` - `string telemetryDestinationID` ID of the telemetry destination (`tdst_...`). - `string workspaceID` ID of the workspace that was removed (`wrkspc_...`). #### Example ```php beta ->organization ->telemetryDestinations ->workspaces ->remove( 'workspace_id', destinationID: 'destination_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaDeletedTelemetryDestinationWorkspace); ``` ##### Response (200) ```json { "telemetry_destination_id": "telemetry_destination_id", "type": "telemetry_destination_workspace_deleted", "workspace_id": "workspace_id" } ``` ## Organization › Webhooks ### Create Organization Webhook Endpoint `$client->beta->organization->webhooks->create(list enabledEvents, string url, ?string description, ?string name, ?list betas): NewOrganizationWebhookEndpoint` **POST** `/v1/organizations/webhooks` Create an organization webhook endpoint. An organization webhook endpoint belongs to the organization rather than to one of its workspaces. An organization can have at most 32 organization webhook endpoints, enabled or disabled. The response includes the endpoint's signing secret. No read returns it, so store it when you receive it. Every request must include the beta header `anthropic-beta: webhooks-2026-10-07`. A request without it returns `404`, exactly as if this API did not exist. Anthropic turns organization webhook endpoints on for each organization; until yours is on, requests also return `404`. Organization webhook endpoints are in beta and are not available to organizations with HIPAA readiness enabled. #### Parameters - `enabledEvents: list` The event types to deliver to the endpoint. Must list at least one. - `url: string` The HTTPS URL that deliveries are sent to. - `description?:optional string` Notes about the endpoint. - `name?:optional string` A short label for the endpoint. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `webhooks-2026-10-07` in this header. #### Returns - `class NewOrganizationWebhookEndpoint` - `string id` ID of the webhook endpoint. - `\Datetime createdAt` When the endpoint was created, in RFC 3339 format. - `string description` Notes about the endpoint. An empty string when none were given. - `string disabledReason` Why Anthropic disabled the endpoint automatically. An empty string when the endpoint is enabled, or when you disabled it. - `list enabledEvents` The event types delivered to the endpoint. - `string name` A short label for the endpoint. An empty string when none was given. - `string signingSecret` The secret Anthropic signs deliveries to the endpoint with (prefix `whsec_`). No other response returns it, so store it now. To replace it, regenerate the signing secret. - `OrganizationWebhookEndpointState state` Whether deliveries are sent to the endpoint. - `\Datetime updatedAt` When the endpoint was last changed, in RFC 3339 format. - `string url` The HTTPS URL that deliveries are sent to. #### Example ```php beta ->organization ->webhooks ->create( enabledEvents: ['user_profile.enforcement_action_opened'], url: 'x', description: 'description', name: 'name', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaNewOrganizationWebhookEndpoint); ``` ##### Response (200) ```json { "id": "id", "created_at": "2019-12-27T18:11:19.117Z", "description": "description", "disabled_reason": "disabled_reason", "enabled_events": [ "user_profile.enforcement_action_opened" ], "name": "name", "signing_secret": "signing_secret", "state": "disabled", "updated_at": "2019-12-27T18:11:19.117Z", "url": "url" } ``` ### List Organization Webhook Endpoints `$client->beta->organization->webhooks->list(?string afterID, ?string beforeID, ?int limit, ?Order order, ?list betas): Page` **GET** `/v1/organizations/webhooks` List the organization's webhook endpoints. An organization webhook endpoint belongs to the organization rather than to one of its workspaces. The list does not include webhook endpoints that belong to a workspace. Every request must include the beta header `anthropic-beta: webhooks-2026-10-07`. A request without it returns `404`, exactly as if this API did not exist. Anthropic turns organization webhook endpoints on for each organization; until yours is on, requests also return `404`. Organization webhook endpoints are in beta and are not available to organizations with HIPAA readiness enabled. #### Parameters - `afterID?:optional string` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `beforeID?:optional string` (query parameter) ID of a webhook endpoint to use as a cursor. Returns the first `limit` endpoints that come before it in list order, not the `limit` endpoints just before it. - `limit?:optional int` (query parameter) Number of items to return per page, up to `100`. The default, `0`, means `20`. default: 0 - `order?:optional Order` (query parameter) Sort order by `created_at`. Defaults to `desc`, newest first. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `webhooks-2026-10-07` in this header. #### Returns - `class OrganizationWebhookEndpoint` - `string id` ID of the webhook endpoint. - `\Datetime createdAt` When the endpoint was created, in RFC 3339 format. - `string description` Notes about the endpoint. An empty string when none were given. - `string disabledReason` Why Anthropic disabled the endpoint automatically. An empty string when the endpoint is enabled, or when you disabled it. - `list enabledEvents` The event types delivered to the endpoint. - `string name` A short label for the endpoint. An empty string when none was given. - `OrganizationWebhookEndpointState state` Whether deliveries are sent to the endpoint. - `\Datetime updatedAt` When the endpoint was last changed, in RFC 3339 format. - `string url` The HTTPS URL that deliveries are sent to. #### Example ```php beta->organization->webhooks->list( afterID: 'after_id', beforeID: 'before_id', limit: 0, order: 'asc', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($page); ``` ##### Response (200) ```json { "data": [ { "id": "id", "created_at": "2019-12-27T18:11:19.117Z", "description": "description", "disabled_reason": "disabled_reason", "enabled_events": [ "user_profile.enforcement_action_opened" ], "name": "name", "state": "disabled", "updated_at": "2019-12-27T18:11:19.117Z", "url": "url" } ], "has_more": true, "first_id": "first_id", "last_id": "last_id" } ``` ### Get Organization Webhook Endpoint `$client->beta->organization->webhooks->retrieve(string webhookEndpointID, ?list betas): OrganizationWebhookEndpoint` **GET** `/v1/organizations/webhooks/{webhook_endpoint_id}` Retrieve an organization webhook endpoint by ID. Every request must include the beta header `anthropic-beta: webhooks-2026-10-07`. A request without it returns `404`, exactly as if this API did not exist. Anthropic turns organization webhook endpoints on for each organization; until yours is on, requests also return `404`. Organization webhook endpoints are in beta and are not available to organizations with HIPAA readiness enabled. #### Parameters - `webhookEndpointID: string` (path parameter) ID of the webhook endpoint. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `webhooks-2026-10-07` in this header. #### Returns - `class OrganizationWebhookEndpoint` - `string id` ID of the webhook endpoint. - `\Datetime createdAt` When the endpoint was created, in RFC 3339 format. - `string description` Notes about the endpoint. An empty string when none were given. - `string disabledReason` Why Anthropic disabled the endpoint automatically. An empty string when the endpoint is enabled, or when you disabled it. - `list enabledEvents` The event types delivered to the endpoint. - `string name` A short label for the endpoint. An empty string when none was given. - `OrganizationWebhookEndpointState state` Whether deliveries are sent to the endpoint. - `\Datetime updatedAt` When the endpoint was last changed, in RFC 3339 format. - `string url` The HTTPS URL that deliveries are sent to. #### Example ```php beta ->organization ->webhooks ->retrieve( 'webhook_endpoint_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24] ); var_dump($betaOrganizationWebhookEndpoint); ``` ##### Response (200) ```json { "id": "id", "created_at": "2019-12-27T18:11:19.117Z", "description": "description", "disabled_reason": "disabled_reason", "enabled_events": [ "user_profile.enforcement_action_opened" ], "name": "name", "state": "disabled", "updated_at": "2019-12-27T18:11:19.117Z", "url": "url" } ``` ### Update Organization Webhook Endpoint `$client->beta->organization->webhooks->update(string webhookEndpointID, ?string description, ?list enabledEvents, ?string name, ?State state, ?string url, ?list betas): OrganizationWebhookEndpoint` **POST** `/v1/organizations/webhooks/{webhook_endpoint_id}` Update an organization webhook endpoint. Only the fields you send are changed. Every request must include the beta header `anthropic-beta: webhooks-2026-10-07`. A request without it returns `404`, exactly as if this API did not exist. Anthropic turns organization webhook endpoints on for each organization; until yours is on, requests also return `404`. Organization webhook endpoints are in beta and are not available to organizations with HIPAA readiness enabled. #### Parameters - `webhookEndpointID: string` (path parameter) ID of the webhook endpoint. - `description?:optional string` Notes about the endpoint. - `enabledEvents?:optional list` The event types to deliver to the endpoint. Replaces the whole set; an empty list leaves it unchanged. - `name?:optional string` A short label for the endpoint. - `state?:optional State` `disabled` stops deliveries. `enabled` resumes them and clears `disabled_reason`. Events that happen while the endpoint is disabled are never delivered. - `url?:optional string` The HTTPS URL that deliveries are sent to. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `webhooks-2026-10-07` in this header. #### Returns - `class OrganizationWebhookEndpoint` - `string id` ID of the webhook endpoint. - `\Datetime createdAt` When the endpoint was created, in RFC 3339 format. - `string description` Notes about the endpoint. An empty string when none were given. - `string disabledReason` Why Anthropic disabled the endpoint automatically. An empty string when the endpoint is enabled, or when you disabled it. - `list enabledEvents` The event types delivered to the endpoint. - `string name` A short label for the endpoint. An empty string when none was given. - `OrganizationWebhookEndpointState state` Whether deliveries are sent to the endpoint. - `\Datetime updatedAt` When the endpoint was last changed, in RFC 3339 format. - `string url` The HTTPS URL that deliveries are sent to. #### Example ```php beta ->organization ->webhooks ->update( 'webhook_endpoint_id', description: 'description', enabledEvents: ['user_profile.enforcement_action_opened'], name: 'name', state: 'disabled', url: 'x', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24], ); var_dump($betaOrganizationWebhookEndpoint); ``` ##### Response (200) ```json { "id": "id", "created_at": "2019-12-27T18:11:19.117Z", "description": "description", "disabled_reason": "disabled_reason", "enabled_events": [ "user_profile.enforcement_action_opened" ], "name": "name", "state": "disabled", "updated_at": "2019-12-27T18:11:19.117Z", "url": "url" } ``` ### Delete Organization Webhook Endpoint `$client->beta->organization->webhooks->delete(string webhookEndpointID, ?list betas): DeletedOrganizationWebhookEndpoint` **DELETE** `/v1/organizations/webhooks/{webhook_endpoint_id}` Delete an organization webhook endpoint. Every request must include the beta header `anthropic-beta: webhooks-2026-10-07`. A request without it returns `404`, exactly as if this API did not exist. Anthropic turns organization webhook endpoints on for each organization; until yours is on, requests also return `404`. Organization webhook endpoints are in beta and are not available to organizations with HIPAA readiness enabled. #### Parameters - `webhookEndpointID: string` (path parameter) ID of the webhook endpoint. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `webhooks-2026-10-07` in this header. #### Returns - `class DeletedOrganizationWebhookEndpoint` - `"webhook_endpoint_deleted" type` Always `webhook_endpoint_deleted`. - `string id` ID of the deleted webhook endpoint. #### Example ```php beta ->organization ->webhooks ->delete( 'webhook_endpoint_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24] ); var_dump($betaDeletedOrganizationWebhookEndpoint); ``` ##### Response (200) ```json { "id": "id", "type": "webhook_endpoint_deleted" } ``` ### Regenerate Organization Webhook Endpoint Signing Secret `$client->beta->organization->webhooks->regenerateSigningSecret(string webhookEndpointID, ?list betas): OrganizationWebhookEndpointSigningSecret` **POST** `/v1/organizations/webhooks/{webhook_endpoint_id}/regenerate_signing_secret` Replace an organization webhook endpoint's signing secret. The old secret stops working immediately. The new secret is returned only in this response. Every request must include the beta header `anthropic-beta: webhooks-2026-10-07`. A request without it returns `404`, exactly as if this API did not exist. Anthropic turns organization webhook endpoints on for each organization; until yours is on, requests also return `404`. Organization webhook endpoints are in beta and are not available to organizations with HIPAA readiness enabled. #### Parameters - `webhookEndpointID: string` (path parameter) ID of the webhook endpoint. - `betas?:optional list` (header parameter) This endpoint is in beta: requests must send `webhooks-2026-10-07` in this header. #### Returns - `class OrganizationWebhookEndpointSigningSecret` - `string signingSecret` The new signing secret. Deliveries are signed with it from now on, and no other response returns it. #### Example ```php beta ->organization ->webhooks ->regenerateSigningSecret( 'webhook_endpoint_id', betas: [AnthropicBeta::MESSAGE_BATCHES_2024_09_24] ); var_dump($betaOrganizationWebhookEndpointSigningSecret); ``` ##### Response (200) ```json { "signing_secret": "signing_secret" } ```