---
title: Organization
url: https://platform.claude.com/docs/en/api/php/organization
---

# Organization

## Get Current Organization

`$client->organization->retrieve(): OrganizationInfo`

**GET** `/v1/organizations/me`

Retrieve information about the organization associated with the authenticated API key.

### Returns

- `class OrganizationInfo`

  - `"organization" type`

    Object type.

    For Organizations, this is always `"organization"`.

  - `string id`

    ID of the Organization.

  - `string name`

    Name of the Organization.

### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$organizationInfo = $client->organization->retrieve();

var_dump($organizationInfo);
```

#### Response (200)

```json
{
  "id": "12345678-1234-5678-1234-567812345678",
  "name": "Organization Name",
  "type": "organization"
}
```

## Domain types

### Organization Info

- `class OrganizationInfo`

  - `"organization" type`

    Object type.

    For Organizations, this is always `"organization"`.

  - `string id`

    ID of the Organization.

  - `string name`

    Name of the Organization.

### Organization Role

- `enum OrganizationRole`

  - `"admin"`

  - `"billing"`

  - `"claude_code_user"`

  - `"developer"`

  - `"managed"`

  - `"membership_admin"`

  - `"owner"`

  - `"primary_owner"`

  - `"user"`

## Organization › API Keys

### List API Keys

`$client->organization->apiKeys->list(?string afterID, ?string beforeID, ?string createdByUserID, ?int limit, ?Status status, ?string workspaceID): Page<APIKey>`

**GET** `/v1/organizations/api_keys`

List API Keys

#### Parameters

- `afterID?:optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.

- `beforeID?:optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.

- `createdByUserID?:optional string` (query parameter)

  Filter by the ID of the User who created the object.

- `limit?:optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

- `status?:optional Status` (query parameter)

  Filter by API key status.

- `workspaceID?:optional string` (query parameter)

  Filter by Workspace ID.

#### Returns

- `class APIKey`

  - `"api_key" type`

    Object type.

    For API Keys, this is always `"api_key"`.

  - `string id`

    ID of the API key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the API Key was created.

  - `?APIKeyCreatedBy createdBy`

    The ID and type of the actor that created the API key, or `null` when the
    creator is not recorded (legacy, workload-identity-federated, or
    system-created keys).

  - `?\Datetime expiresAt`

    RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.

  - `string name`

    Name of the API key.

  - `?string partialKeyHint`

    Partially redacted hint for the API key.

  - `?Principal principal`

    The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.

  - `Scope scope`

    Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.

  - `Status status`

    Status of the API key.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->apiKeys->list(
  afterID: 'after_id',
  beforeID: 'before_id',
  createdByUserID: 'created_by_user_id',
  limit: 1,
  status: 'active',
  workspaceID: 'workspace_id',
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by": {
        "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
        "type": "user"
      },
      "expires_at": "2024-10-30T23:58:27.427722Z",
      "name": "Developer Key",
      "partial_key_hint": "sk-ant-api03-R2D...igAA",
      "principal": {
        "type": "user_actor",
        "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
      },
      "scope": {
        "type": "workspace",
        "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
      },
      "status": "active",
      "type": "api_key"
    }
  ],
  "first_id": "first_id",
  "has_more": true,
  "last_id": "last_id"
}
```

### Retrieve API Key (Admin API)

`$client->organization->apiKeys->retrieve(string apiKeyID): APIKey`

**GET** `/v1/organizations/api_keys/{api_key_id}`

Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to [API keys](https://platform.claude.com/settings/keys) in the Claude Console.

#### Parameters

- `apiKeyID: string` (path parameter)

  ID of the API key.

#### Returns

- `class APIKey`

  - `"api_key" type`

    Object type.

    For API Keys, this is always `"api_key"`.

  - `string id`

    ID of the API key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the API Key was created.

  - `?APIKeyCreatedBy createdBy`

    The ID and type of the actor that created the API key, or `null` when the
    creator is not recorded (legacy, workload-identity-federated, or
    system-created keys).

  - `?\Datetime expiresAt`

    RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.

  - `string name`

    Name of the API key.

  - `?string partialKeyHint`

    Partially redacted hint for the API key.

  - `?Principal principal`

    The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.

  - `Scope scope`

    Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.

  - `Status status`

    Status of the API key.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$apiKey = $client->organization->apiKeys->retrieve('api_key_id');

var_dump($apiKey);
```

##### Response (200)

```json
{
  "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by": {
    "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
    "type": "user"
  },
  "expires_at": "2024-10-30T23:58:27.427722Z",
  "name": "Developer Key",
  "partial_key_hint": "sk-ant-api03-R2D...igAA",
  "principal": {
    "type": "user_actor",
    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
  },
  "scope": {
    "type": "workspace",
    "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
  },
  "status": "active",
  "type": "api_key"
}
```

### Update API Key

`$client->organization->apiKeys->update(string apiKeyID, ?string name, ?Status status): APIKey`

**POST** `/v1/organizations/api_keys/{api_key_id}`

Update API Key

#### Parameters

- `apiKeyID: string` (path parameter)

  ID of the API key.

- `name?:optional string`

  Name of the API key.

- `status?:optional Status`

  Status of the API key.

#### Returns

- `class APIKey`

  - `"api_key" type`

    Object type.

    For API Keys, this is always `"api_key"`.

  - `string id`

    ID of the API key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the API Key was created.

  - `?APIKeyCreatedBy createdBy`

    The ID and type of the actor that created the API key, or `null` when the
    creator is not recorded (legacy, workload-identity-federated, or
    system-created keys).

  - `?\Datetime expiresAt`

    RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.

  - `string name`

    Name of the API key.

  - `?string partialKeyHint`

    Partially redacted hint for the API key.

  - `?Principal principal`

    The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.

  - `Scope scope`

    Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.

  - `Status status`

    Status of the API key.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$apiKey = $client->organization->apiKeys->update(
  'api_key_id', name: 'x', status: 'active'
);

var_dump($apiKey);
```

##### Response (200)

```json
{
  "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by": {
    "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
    "type": "user"
  },
  "expires_at": "2024-10-30T23:58:27.427722Z",
  "name": "Developer Key",
  "partial_key_hint": "sk-ant-api03-R2D...igAA",
  "principal": {
    "type": "user_actor",
    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
  },
  "scope": {
    "type": "workspace",
    "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
  },
  "status": "active",
  "type": "api_key"
}
```

## Organization › External Keys

### Create External Key

`$client->organization->externalKeys->create(ProviderConfig providerConfig, ?string displayName, ?Geo geo): ExternalKey`

**POST** `/v1/organizations/external_keys`

Create an external key config owned by the caller's organization.

#### Parameters

- `providerConfig: ProviderConfig`

  KMS provider identity and auth coordinates.

- `displayName?:optional string`

  Human-friendly display name.

- `geo?:optional Geo`

  Data residency geo. Only `us` is supported.

#### Returns

- `class ExternalKey`

  - `"external_key" type`

  - `string id`

    Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.

  - `Attachment attachment`

    Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.

  - `\Datetime createdAt`

  - `?string displayName`

    Human-friendly display name. Null if none was set.

  - `string geo`

    Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.

  - `ProviderConfig providerConfig`

    KMS provider identity and auth coordinates.

  - `\Datetime updatedAt`

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$externalKey = $client->organization->externalKeys->create(
  providerConfig: [
    'kmsARN' => 'arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222',
    'type' => 'aws',
    'region' => 'us-east-1',
  ],
  displayName: 'x',
  geo: 'us',
);

var_dump($externalKey);
```

##### Response (200)

```json
{
  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "attachment": {
    "type": "attached"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "prod-us-key",
  "geo": "us",
  "provider_config": {
    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
    "type": "aws",
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
  },
  "type": "external_key",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}
```

### List External Keys

`$client->organization->externalKeys->list(?int limit, ?string page): PageCursor<ExternalKey>`

**GET** `/v1/organizations/external_keys`

List external key configs in the caller's organization.

Results are ordered by creation time (newest first). Use the
`next_page` cursor from the response to fetch subsequent pages.

#### Parameters

- `limit?:optional int` (query parameter)

  Number of results per page.

  default: 20

- `page?:optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class ExternalKey`

  - `"external_key" type`

  - `string id`

    Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.

  - `Attachment attachment`

    Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.

  - `\Datetime createdAt`

  - `?string displayName`

    Human-friendly display name. Null if none was set.

  - `string geo`

    Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.

  - `ProviderConfig providerConfig`

    KMS provider identity and auth coordinates.

  - `\Datetime updatedAt`

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->externalKeys->list(limit: 1, page: 'page');

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
      "attachment": {
        "type": "attached"
      },
      "created_at": "2024-10-30T23:58:27.427722Z",
      "display_name": "prod-us-key",
      "geo": "us",
      "provider_config": {
        "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
        "type": "aws",
        "region": "us-east-1",
        "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
      },
      "type": "external_key",
      "updated_at": "2024-10-30T23:58:27.427722Z"
    }
  ],
  "next_page": "next_page"
}
```

### Get External Key

`$client->organization->externalKeys->retrieve(string externalKeyID): ExternalKey`

**GET** `/v1/organizations/external_keys/{external_key_id}`

Retrieve a single external key config in the caller's organization by ID.

#### Parameters

- `externalKeyID: string` (path parameter)

  ID of the External Key.

#### Returns

- `class ExternalKey`

  - `"external_key" type`

  - `string id`

    Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.

  - `Attachment attachment`

    Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.

  - `\Datetime createdAt`

  - `?string displayName`

    Human-friendly display name. Null if none was set.

  - `string geo`

    Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.

  - `ProviderConfig providerConfig`

    KMS provider identity and auth coordinates.

  - `\Datetime updatedAt`

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$externalKey = $client->organization->externalKeys->retrieve('external_key_id');

var_dump($externalKey);
```

##### Response (200)

```json
{
  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "attachment": {
    "type": "attached"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "prod-us-key",
  "geo": "us",
  "provider_config": {
    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
    "type": "aws",
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
  },
  "type": "external_key",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}
```

### Update External Key

`$client->organization->externalKeys->update(string externalKeyID, ?string displayName, ?Geo geo, ?ProviderConfig providerConfig): ExternalKey`

**POST** `/v1/organizations/external_keys/{external_key_id}`

Partially update an external key config. Omitted fields are left unchanged.

`display_name` is always editable. `geo` and `provider_config` cannot
be changed once any workspace references this config, because previously
encrypted data requires the original key identity to decrypt.

#### Parameters

- `externalKeyID: string` (path parameter)

  ID of the External Key.

- `displayName?:optional string`

  Human-friendly display name.

- `geo?:optional Geo`

  Data residency geo. Only `us` is supported.

- `providerConfig?:optional ProviderConfig`

  KMS provider identity and auth coordinates.

#### Returns

- `class ExternalKey`

  - `"external_key" type`

  - `string id`

    Identifier of the external key config. A tagged ID prefixed `ekey_`, or — for organizations on the Claude Platform on AWS — the AWS KMS key ARN.

  - `Attachment attachment`

    Whether any workspace uses this config to encrypt its data — counting live and archived workspaces (an archived workspace's data remains encrypted under the config), excluding deleted ones. Only an attached config is used by the encryption path; an `unattached` config is inert and can be deleted.

  - `\Datetime createdAt`

  - `?string displayName`

    Human-friendly display name. Null if none was set.

  - `string geo`

    Data residency geo. Selects which regional validator handles this key's encrypt/decrypt roundtrips.

  - `ProviderConfig providerConfig`

    KMS provider identity and auth coordinates.

  - `\Datetime updatedAt`

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$externalKey = $client->organization->externalKeys->update(
  'external_key_id',
  displayName: 'x',
  geo: 'us',
  providerConfig: [
    'kmsARN' => 'arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222',
    'type' => 'aws',
    'region' => 'us-east-1',
  ],
);

var_dump($externalKey);
```

##### Response (200)

```json
{
  "id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "attachment": {
    "type": "attached"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "display_name": "prod-us-key",
  "geo": "us",
  "provider_config": {
    "kms_arn": "arn:aws:kms:us-east-1:111122223333:key/abcd1234-5678-90ab-cdef-000011112222",
    "type": "aws",
    "region": "us-east-1",
    "role_arn": "arn:aws:iam::111122223333:role/anthropic-cmek"
  },
  "type": "external_key",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}
```

### Delete External Key

`$client->organization->externalKeys->delete(string externalKeyID): ExternalKeyDeleteResponse`

**DELETE** `/v1/organizations/external_keys/{external_key_id}`

Delete an external key config.

The request is rejected if any workspace still references this config.

#### Parameters

- `externalKeyID: string` (path parameter)

  ID of the External Key.

#### Returns

- `class ExternalKeyDeleteResponse`

  - `"external_key_deleted" type`

  - `string id`

    ID of the deleted External Key.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$externalKey = $client->organization->externalKeys->delete('external_key_id');

var_dump($externalKey);
```

##### Response (200)

```json
{
  "id": "ekey_01AbCdEfGhIjKlMnOpQrStUv",
  "type": "external_key_deleted"
}
```

### Validate External Key

`$client->organization->externalKeys->validate(string externalKeyID): ExternalKeyValidateResponse`

**POST** `/v1/organizations/external_keys/{external_key_id}/validate`

Validate an external key config against the customer's KMS.

Anthropic performs an encrypt/decrypt roundtrip against the configured
KMS key and waits up to 30 seconds for the result. The response status is
`success` if the roundtrip succeeded, or `failure` with an error
message if it failed or timed out.

#### Parameters

- `externalKeyID: string` (path parameter)

  ID of the External Key.

#### Returns

- `class ExternalKeyValidateResponse`

  - `"external_key_validation" type`

  - `?string error`

    Error message when status is `failure`. Null otherwise.

  - `Status status`

    `success` — encrypt/decrypt roundtrip succeeded. `failure` — the roundtrip failed or timed out; see `error`.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$response = $client->organization->externalKeys->validate('external_key_id');

var_dump($response);
```

##### Response (200)

```json
{
  "error": "error",
  "status": "failure",
  "type": "external_key_validation"
}
```

## Organization › Federation › Issuers

### Create Federation Issuer

`$client->organization->federation->issuers->create(string issuerURL, string name, ?bool checkJTI, ?JWKS jwks, ?int maxJWTLifetimeSeconds): FederationIssuer`

**POST** `/v1/organizations/federation_issuers`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Register an OIDC issuer that Anthropic will trust for workload identity
federation in your organization.

The `jwks` field controls how the issuer's signing keys are obtained and
takes one of three shapes selected by `type`: `discovery` (resolve keys
through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS
URL), or `inline` (provide a static key set). When `jwks.type` is
`discovery` and no `discovery_base` is set, the issuer URL must be
publicly reachable over HTTPS so Anthropic can fetch the discovery
document; for `explicit_url` and `inline` modes the issuer URL is only
matched as the JWT's `iss` claim and is not fetched.

#### Parameters

- `issuerURL: string`

  The `iss` claim value to match against.

- `name: string`

  Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

- `checkJTI?:optional bool`

  Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.

- `jwks?:optional JWKS`

  How signing keys are obtained. Defaults to OIDC discovery.

- `maxJWTLifetimeSeconds?:optional int`

  Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.

#### Returns

- `class FederationIssuer`

  - `"federation_issuer" type`

  - `string id`

    Tagged ID of the federation issuer.

  - `?\Datetime archivedAt`

    If set, all rules referencing this issuer reject token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.

  - `bool checkJTI`

    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.

  - `\Datetime createdAt`

    When this issuer was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.

  - `string issuerURL`

    The `iss` claim value. Incoming JWTs must match exactly.

  - `JWKS jwks`

    How signing keys are obtained for signature verification.

  - `?\Datetime jwksPollingDisabledAt`

    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.

  - `int maxJWTLifetimeSeconds`

    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.

  - `string name`

    Admin-chosen slug identifier.

  - `?FederationIssuerPollStatus pollStatus`

    Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

  - `\Datetime updatedAt`

    When this issuer was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationIssuer = $client->organization->federation->issuers->create(
  issuerURL: 'x',
  name: 'x',
  checkJTI: true,
  jwks: [
    'type' => 'discovery',
    'caCertPEM' => 'ca_cert_pem',
    'discoveryBase' => 'discovery_base',
  ],
  maxJWTLifetimeSeconds: 1,
);

var_dump($federationIssuer);
```

##### Response (200)

```json
{
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "check_jti": true,
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "jwks": {
    "type": "discovery",
    "ca_cert_pem": "ca_cert_pem",
    "discovery_base": "discovery_base"
  },
  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
  "max_jwt_lifetime_seconds": 0,
  "name": "github-actions",
  "poll_status": {
    "consecutive_failures": 0,
    "last_fetched_at": "2019-12-27T18:11:19.117Z",
    "next_poll_at": "2019-12-27T18:11:19.117Z"
  },
  "type": "federation_issuer",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

### List Federation Issuers

`$client->organization->federation->issuers->list(?bool includeArchived, ?int limit, ?string page): PageCursor<FederationIssuer>`

**GET** `/v1/organizations/federation_issuers`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

List federation issuers in your organization.

Archived issuers are excluded unless `include_archived=true`.

#### Parameters

- `includeArchived?:optional bool` (query parameter)

  Include archived resources. Defaults to false.

  default: false

- `limit?:optional int` (query parameter)

  Number of results per page.

  default: 20

- `page?:optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class FederationIssuer`

  - `"federation_issuer" type`

  - `string id`

    Tagged ID of the federation issuer.

  - `?\Datetime archivedAt`

    If set, all rules referencing this issuer reject token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.

  - `bool checkJTI`

    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.

  - `\Datetime createdAt`

    When this issuer was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.

  - `string issuerURL`

    The `iss` claim value. Incoming JWTs must match exactly.

  - `JWKS jwks`

    How signing keys are obtained for signature verification.

  - `?\Datetime jwksPollingDisabledAt`

    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.

  - `int maxJWTLifetimeSeconds`

    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.

  - `string name`

    Admin-chosen slug identifier.

  - `?FederationIssuerPollStatus pollStatus`

    Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

  - `\Datetime updatedAt`

    When this issuer was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->federation->issuers->list(
  includeArchived: true, limit: 1, page: 'page'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
      "archived_at": "2019-12-27T18:11:19.117Z",
      "archived_by_actor_id": "archived_by_actor_id",
      "check_jti": true,
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by_actor_id": "created_by_actor_id",
      "issuer_url": "https://token.actions.githubusercontent.com",
      "jwks": {
        "type": "discovery",
        "ca_cert_pem": "ca_cert_pem",
        "discovery_base": "discovery_base"
      },
      "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
      "max_jwt_lifetime_seconds": 0,
      "name": "github-actions",
      "poll_status": {
        "consecutive_failures": 0,
        "last_fetched_at": "2019-12-27T18:11:19.117Z",
        "next_poll_at": "2019-12-27T18:11:19.117Z"
      },
      "type": "federation_issuer",
      "updated_at": "2024-10-30T23:58:27.427722Z",
      "updated_by_actor_id": "updated_by_actor_id"
    }
  ],
  "next_page": "next_page"
}
```

### Get Federation Issuer

`$client->organization->federation->issuers->retrieve(string federationIssuerID): FederationIssuer`

**GET** `/v1/organizations/federation_issuers/{federation_issuer_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Retrieve a federation issuer by its ID (`fdis_...`).

#### Parameters

- `federationIssuerID: string` (path parameter)

  ID of the federation issuer.

#### Returns

- `class FederationIssuer`

  - `"federation_issuer" type`

  - `string id`

    Tagged ID of the federation issuer.

  - `?\Datetime archivedAt`

    If set, all rules referencing this issuer reject token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.

  - `bool checkJTI`

    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.

  - `\Datetime createdAt`

    When this issuer was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.

  - `string issuerURL`

    The `iss` claim value. Incoming JWTs must match exactly.

  - `JWKS jwks`

    How signing keys are obtained for signature verification.

  - `?\Datetime jwksPollingDisabledAt`

    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.

  - `int maxJWTLifetimeSeconds`

    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.

  - `string name`

    Admin-chosen slug identifier.

  - `?FederationIssuerPollStatus pollStatus`

    Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

  - `\Datetime updatedAt`

    When this issuer was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationIssuer = $client->organization->federation->issuers->retrieve(
  'federation_issuer_id'
);

var_dump($federationIssuer);
```

##### Response (200)

```json
{
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "check_jti": true,
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "jwks": {
    "type": "discovery",
    "ca_cert_pem": "ca_cert_pem",
    "discovery_base": "discovery_base"
  },
  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
  "max_jwt_lifetime_seconds": 0,
  "name": "github-actions",
  "poll_status": {
    "consecutive_failures": 0,
    "last_fetched_at": "2019-12-27T18:11:19.117Z",
    "next_poll_at": "2019-12-27T18:11:19.117Z"
  },
  "type": "federation_issuer",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

### Update Federation Issuer

`$client->organization->federation->issuers->update(string federationIssuerID, ?bool checkJTI, ?string issuerURL, ?JWKS jwks, ?bool jwksPollingDisabled, ?int maxJWTLifetimeSeconds, ?string name): FederationIssuer`

**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Partially update a federation issuer.

Setting `jwks` replaces the full JWKS shape at once. Archived issuers
cannot be updated; this returns 400. Create a new issuer instead.

Updating an issuer that backs a rule with a scope outside
`workspace:developer` or `workspace:inference` requires a Console
session.

#### Parameters

- `federationIssuerID: string` (path parameter)

  ID of the federation issuer to update.

- `checkJTI?:optional bool`

  Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.

- `issuerURL?:optional string`

  Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity.

- `jwks?:optional JWKS`

  Replaces the entire JWKS configuration.

- `jwksPollingDisabled?:optional bool`

  Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected.

- `maxJWTLifetimeSeconds?:optional int`

  Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.

- `name?:optional string`

  Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

#### Returns

- `class FederationIssuer`

  - `"federation_issuer" type`

  - `string id`

    Tagged ID of the federation issuer.

  - `?\Datetime archivedAt`

    If set, all rules referencing this issuer reject token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.

  - `bool checkJTI`

    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.

  - `\Datetime createdAt`

    When this issuer was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.

  - `string issuerURL`

    The `iss` claim value. Incoming JWTs must match exactly.

  - `JWKS jwks`

    How signing keys are obtained for signature verification.

  - `?\Datetime jwksPollingDisabledAt`

    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.

  - `int maxJWTLifetimeSeconds`

    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.

  - `string name`

    Admin-chosen slug identifier.

  - `?FederationIssuerPollStatus pollStatus`

    Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

  - `\Datetime updatedAt`

    When this issuer was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationIssuer = $client->organization->federation->issuers->update(
  'federation_issuer_id',
  checkJTI: true,
  issuerURL: 'x',
  jwks: [
    'type' => 'discovery',
    'caCertPEM' => 'ca_cert_pem',
    'discoveryBase' => 'discovery_base',
  ],
  jwksPollingDisabled: true,
  maxJWTLifetimeSeconds: 1,
  name: 'x',
);

var_dump($federationIssuer);
```

##### Response (200)

```json
{
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "check_jti": true,
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "jwks": {
    "type": "discovery",
    "ca_cert_pem": "ca_cert_pem",
    "discovery_base": "discovery_base"
  },
  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
  "max_jwt_lifetime_seconds": 0,
  "name": "github-actions",
  "poll_status": {
    "consecutive_failures": 0,
    "last_fetched_at": "2019-12-27T18:11:19.117Z",
    "next_poll_at": "2019-12-27T18:11:19.117Z"
  },
  "type": "federation_issuer",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

### Archive Federation Issuer

`$client->organization->federation->issuers->archive(string federationIssuerID): FederationIssuer`

**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Archive a federation issuer.

Idempotent; re-archiving returns the issuer with its original
`archived_at`. Rejected with 400 if any live (non-archived) federation
rule still references the issuer; archive those rules first (a rule's
issuer cannot be changed), or recreate them against another issuer.

#### Parameters

- `federationIssuerID: string` (path parameter)

  ID of the federation issuer to archive.

#### Returns

- `class FederationIssuer`

  - `"federation_issuer" type`

  - `string id`

    Tagged ID of the federation issuer.

  - `?\Datetime archivedAt`

    If set, all rules referencing this issuer reject token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.

  - `bool checkJTI`

    Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.

  - `\Datetime createdAt`

    When this issuer was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this issuer.

  - `string issuerURL`

    The `iss` claim value. Incoming JWTs must match exactly.

  - `JWKS jwks`

    How signing keys are obtained for signature verification.

  - `?\Datetime jwksPollingDisabledAt`

    If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.

  - `int maxJWTLifetimeSeconds`

    Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.

  - `string name`

    Admin-chosen slug identifier.

  - `?FederationIssuerPollStatus pollStatus`

    Live state of Anthropic's JWKS polling for this issuer. Populated on both single-issuer retrieval and list responses, including archived issuers. Typically null for inline-key issuers (no polling), or when poll status is temporarily unavailable or polling has not started yet.

  - `\Datetime updatedAt`

    When this issuer was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationIssuer = $client->organization->federation->issuers->archive(
  'federation_issuer_id'
);

var_dump($federationIssuer);
```

##### Response (200)

```json
{
  "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "check_jti": true,
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "issuer_url": "https://token.actions.githubusercontent.com",
  "jwks": {
    "type": "discovery",
    "ca_cert_pem": "ca_cert_pem",
    "discovery_base": "discovery_base"
  },
  "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",
  "max_jwt_lifetime_seconds": 0,
  "name": "github-actions",
  "poll_status": {
    "consecutive_failures": 0,
    "last_fetched_at": "2019-12-27T18:11:19.117Z",
    "next_poll_at": "2019-12-27T18:11:19.117Z"
  },
  "type": "federation_issuer",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

## Organization › Federation › Rules

### Create Federation Rule

`$client->organization->federation->rules->create(string issuerID, FederationRuleMatch match, string name, string oauthScope, ServiceAccountTarget target, ?bool appliesToAllWorkspaces, ?string description, ?int tokenLifetimeSeconds, ?string workspaceID): FederationRule`

**POST** `/v1/organizations/federation_rules`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Create a federation rule owned by your organization.

The referenced issuer and the target service account must already exist
in the same organization; invalid references are rejected with a 400
error. The workspace reference is validated. Membership is not checked
at rule creation: token exchange resolves a single enabled workspace per
call and is rejected unless the target service account is a member of
that workspace (it is implicitly a member of the default workspace).
Rules on well-known shared issuers (GitHub Actions, GitLab, Buildkite,
Terraform Cloud, Google) must constrain tenant identity via an
identity-bearing claim, a tenant-pinning subject prefix (such as
`repo:YOUR_ORG/...`), or a CEL condition referencing one of those
identity claims (e.g. `claims.repository_owner`). OAuth callers may only
manage rules whose `oauth_scope` is `workspace:developer` or
`workspace:inference`; other scopes require a Console session.

#### Parameters

- `issuerID: string`

  Tagged ID of the federation issuer.

- `match: FederationRuleMatch`

  Conditions the verified JWT must satisfy for this rule to apply. At least one of `subject_prefix` (other than a wildcard-only value like `*`), `claims`, or `condition` is required; `audience` alone is not sufficient.

- `name: string`

  Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

- `oauthScope: string`

  Space-separated OAuth scopes. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.

- `target: ServiceAccountTarget`

  Identity that tokens minted via this rule act as. Currently always a `service_account` target.

- `appliesToAllWorkspaces?:optional bool`

  When true, enable this rule for every workspace in the org (including workspaces created later).

- `description?:optional string`

  Optional free-text description.

- `tokenLifetimeSeconds?:optional int`

  Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

- `workspaceID?:optional string`

  Tagged ID of the workspace to enable this rule for. Required unless `applies_to_all_workspaces` is true. Additional workspaces can be added via the `/federation_rules/{federation_rule_id}/workspaces` sub-resource.

#### Returns

- `class FederationRule`

  - `"federation_rule" type`

  - `string id`

    Tagged ID of the federation rule.

  - `bool appliesToAllWorkspaces`

    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.

  - `?\Datetime archivedAt`

    If set, this rule is archived and rejects token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.

  - `\Datetime createdAt`

    When this rule was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this rule.

  - `?string description`

    Optional free-text description.

  - `string issuerID`

    Tagged ID of the issuer whose tokens this rule accepts.

  - `?string issuerName`

    Issuer's display name at read time.

  - `FederationRuleMatch match`

    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

  - `string name`

    Admin-chosen slug identifier.

  - `string oauthScope`

    Space-separated OAuth scopes granted on the minted token.

  - `ServiceAccountTarget target`

    What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account.

  - `int tokenLifetimeSeconds`

    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

  - `\Datetime updatedAt`

    When this rule was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.

  - `list<string> workspaceIDs`

    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationRule = $client->organization->federation->rules->create(
  issuerID: 'issuer_id',
  match: [
    'audience' => 'audience',
    'claims' => ['foo' => 'string'],
    'condition' => 'condition',
    'subjectPrefix' => 'subject_prefix',
  ],
  name: 'x',
  oauthScope: 'x',
  target: [
    'serviceAccountID' => 'svac_01SDCCSbTxrXDpWc1phhtcfK',
    'type' => 'service_account',
    'serviceAccountName' => 'service_account_name',
  ],
  appliesToAllWorkspaces: true,
  description: 'description',
  tokenLifetimeSeconds: 60,
  workspaceID: 'workspace_id',
);

var_dump($federationRule);
```

##### Response (200)

```json
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}
```

### List Federation Rules

`$client->organization->federation->rules->list(?bool includeArchived, ?string issuerID, ?int limit, ?string page): PageCursor<FederationRule>`

**GET** `/v1/organizations/federation_rules`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

List federation rules in your organization.

Optionally filter by issuer with `issuer_id`. Archived rules are excluded
unless `include_archived=true`.

#### Parameters

- `includeArchived?:optional bool` (query parameter)

  Include archived resources. Defaults to false.

  default: false

- `issuerID?:optional string` (query parameter)

  Filter to rules referencing this federation issuer.

- `limit?:optional int` (query parameter)

  Number of results per page.

  default: 20

- `page?:optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class FederationRule`

  - `"federation_rule" type`

  - `string id`

    Tagged ID of the federation rule.

  - `bool appliesToAllWorkspaces`

    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.

  - `?\Datetime archivedAt`

    If set, this rule is archived and rejects token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.

  - `\Datetime createdAt`

    When this rule was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this rule.

  - `?string description`

    Optional free-text description.

  - `string issuerID`

    Tagged ID of the issuer whose tokens this rule accepts.

  - `?string issuerName`

    Issuer's display name at read time.

  - `FederationRuleMatch match`

    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

  - `string name`

    Admin-chosen slug identifier.

  - `string oauthScope`

    Space-separated OAuth scopes granted on the minted token.

  - `ServiceAccountTarget target`

    What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account.

  - `int tokenLifetimeSeconds`

    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

  - `\Datetime updatedAt`

    When this rule was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.

  - `list<string> workspaceIDs`

    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->federation->rules->list(
  includeArchived: true, issuerID: 'issuer_id', limit: 1, page: 'page'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
      "applies_to_all_workspaces": true,
      "archived_at": "2019-12-27T18:11:19.117Z",
      "archived_by_actor_id": "archived_by_actor_id",
      "attributes": {
        "foo": "string"
      },
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by_actor_id": "created_by_actor_id",
      "description": "description",
      "issuer_id": "issuer_id",
      "issuer_name": "issuer_name",
      "match": {
        "audience": "audience",
        "claims": {
          "foo": "string"
        },
        "condition": "condition",
        "subject_prefix": "subject_prefix"
      },
      "name": "prod-deploy-pipeline",
      "oauth_scope": "oauth_scope",
      "target": {
        "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
        "type": "service_account",
        "service_account_name": "service_account_name"
      },
      "token_lifetime_seconds": 0,
      "type": "federation_rule",
      "updated_at": "2024-10-30T23:58:27.427722Z",
      "updated_by_actor_id": "updated_by_actor_id",
      "workspace_id": "workspace_id",
      "workspace_ids": [
        "string"
      ]
    }
  ],
  "next_page": "next_page"
}
```

### Get Federation Rule

`$client->organization->federation->rules->retrieve(string federationRuleID): FederationRule`

**GET** `/v1/organizations/federation_rules/{federation_rule_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Retrieve a federation rule by its ID (`fdrl_...`).

#### Parameters

- `federationRuleID: string` (path parameter)

  ID of the federation rule.

#### Returns

- `class FederationRule`

  - `"federation_rule" type`

  - `string id`

    Tagged ID of the federation rule.

  - `bool appliesToAllWorkspaces`

    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.

  - `?\Datetime archivedAt`

    If set, this rule is archived and rejects token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.

  - `\Datetime createdAt`

    When this rule was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this rule.

  - `?string description`

    Optional free-text description.

  - `string issuerID`

    Tagged ID of the issuer whose tokens this rule accepts.

  - `?string issuerName`

    Issuer's display name at read time.

  - `FederationRuleMatch match`

    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

  - `string name`

    Admin-chosen slug identifier.

  - `string oauthScope`

    Space-separated OAuth scopes granted on the minted token.

  - `ServiceAccountTarget target`

    What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account.

  - `int tokenLifetimeSeconds`

    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

  - `\Datetime updatedAt`

    When this rule was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.

  - `list<string> workspaceIDs`

    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationRule = $client->organization->federation->rules->retrieve(
  'federation_rule_id'
);

var_dump($federationRule);
```

##### Response (200)

```json
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}
```

### Update Federation Rule

`$client->organization->federation->rules->update(string federationRuleID, ?bool appliesToAllWorkspaces, ?string description, ?FederationRuleMatch match, ?string name, ?string oauthScope, ?ServiceAccountTarget target, ?int tokenLifetimeSeconds, ?string workspaceID): FederationRule`

**POST** `/v1/organizations/federation_rules/{federation_rule_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Partially update a federation rule.

`issuer_id` is immutable. `match` and `target` are replaced as whole
objects when set. Referenced service accounts and workspaces must exist
in your organization; invalid references are rejected with a 400 error.
Archived rules cannot be updated; this returns 400. Create a new rule
instead. Rules on well-known shared issuers (GitHub Actions, GitLab,
Buildkite, Terraform Cloud, Google) must constrain tenant identity via
an identity-bearing claim, a tenant-pinning subject prefix (such as
`repo:YOUR_ORG/...`), or a CEL condition referencing one of those
identity claims (e.g. `claims.repository_owner`). On these issuers the
requirement is re-checked on every update; if an existing rule's stored
match does not yet constrain tenant identity, any update (even a rename
or description change) must also supply a conforming `match` in the same
request. OAuth callers may only manage rules whose `oauth_scope` is
`workspace:developer` or `workspace:inference`; other scopes require a
Console session.

#### Parameters

- `federationRuleID: string` (path parameter)

  ID of the federation rule to update.

- `appliesToAllWorkspaces?:optional bool`

  When true, enables this rule for every workspace in the org (including workspaces created later). Setting `false` is rejected with 400 if no workspace would remain enabled; a rule with only a legacy `workspace_id` binding continues to mint.

- `description?:optional string`

  Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).

- `match?:optional FederationRuleMatch`

  Replaces the entire match object. All populated matcher fields must pass.

- `name?:optional string`

  Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

- `oauthScope?:optional string`

  Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set `workspace:developer` or `workspace:inference`; other scopes (such as `org:admin`) require a Console session.

- `target?:optional ServiceAccountTarget`

  Replaces the entire target object. Currently always a `service_account` target.

- `tokenLifetimeSeconds?:optional int`

  Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

- `workspaceID?:optional string`

  Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the `/federation_rules/{federation_rule_id}/workspaces` sub-resource instead.

#### Returns

- `class FederationRule`

  - `"federation_rule" type`

  - `string id`

    Tagged ID of the federation rule.

  - `bool appliesToAllWorkspaces`

    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.

  - `?\Datetime archivedAt`

    If set, this rule is archived and rejects token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.

  - `\Datetime createdAt`

    When this rule was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this rule.

  - `?string description`

    Optional free-text description.

  - `string issuerID`

    Tagged ID of the issuer whose tokens this rule accepts.

  - `?string issuerName`

    Issuer's display name at read time.

  - `FederationRuleMatch match`

    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

  - `string name`

    Admin-chosen slug identifier.

  - `string oauthScope`

    Space-separated OAuth scopes granted on the minted token.

  - `ServiceAccountTarget target`

    What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account.

  - `int tokenLifetimeSeconds`

    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

  - `\Datetime updatedAt`

    When this rule was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.

  - `list<string> workspaceIDs`

    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationRule = $client->organization->federation->rules->update(
  'federation_rule_id',
  appliesToAllWorkspaces: true,
  description: 'description',
  match: [
    'audience' => 'audience',
    'claims' => ['foo' => 'string'],
    'condition' => 'condition',
    'subjectPrefix' => 'subject_prefix',
  ],
  name: 'x',
  oauthScope: 'x',
  target: [
    'serviceAccountID' => 'svac_01SDCCSbTxrXDpWc1phhtcfK',
    'type' => 'service_account',
    'serviceAccountName' => 'service_account_name',
  ],
  tokenLifetimeSeconds: 60,
  workspaceID: 'workspace_id',
);

var_dump($federationRule);
```

##### Response (200)

```json
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}
```

### Archive Federation Rule

`$client->organization->federation->rules->archive(string federationRuleID): FederationRule`

**POST** `/v1/organizations/federation_rules/{federation_rule_id}/archive`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Archive a federation rule.

Token exchange through this rule stops immediately. Idempotent;
re-archiving returns the rule with its original `archived_at`. Archiving
clears the rule's workspace targeting (`workspace_id` and
`workspace_ids` are emptied). Tokens already minted before archive
remain valid until they expire. OAuth callers may only manage rules
whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
other scopes require a Console session.

#### Parameters

- `federationRuleID: string` (path parameter)

  ID of the federation rule to archive.

#### Returns

- `class FederationRule`

  - `"federation_rule" type`

  - `string id`

    Tagged ID of the federation rule.

  - `bool appliesToAllWorkspaces`

    When true, this rule is enabled for every workspace in the org (including ones created after the rule). `workspace_ids` is ignored at exchange time.

  - `?\Datetime archivedAt`

    If set, this rule is archived and rejects token exchange.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this rule.

  - `\Datetime createdAt`

    When this rule was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this rule.

  - `?string description`

    Optional free-text description.

  - `string issuerID`

    Tagged ID of the issuer whose tokens this rule accepts.

  - `?string issuerName`

    Issuer's display name at read time.

  - `FederationRuleMatch match`

    Conditions the verified JWT must satisfy for this rule to apply. All populated matcher fields must pass.

  - `string name`

    Admin-chosen slug identifier.

  - `string oauthScope`

    Space-separated OAuth scopes granted on the minted token.

  - `ServiceAccountTarget target`

    What this rule targets. Check `type` before reading the other fields. Tokens minted via a rule whose target `type` is `service_account` act as that service account.

  - `int tokenLifetimeSeconds`

    Lifetime in seconds of access tokens minted via this rule. Minted tokens are capped at `max(60, min(this value, 2 × remaining assertion validity))` seconds.

  - `\Datetime updatedAt`

    When this rule was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this rule.

  - `list<string> workspaceIDs`

    Tagged IDs of the workspaces this rule is enabled for. May be empty for older rules that only carry the legacy `workspace_id` binding. Ignored at exchange time when `applies_to_all_workspaces` is true (the list may still be non-empty).

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationRule = $client->organization->federation->rules->archive(
  'federation_rule_id'
);

var_dump($federationRule);
```

##### Response (200)

```json
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}
```

## Organization › Federation › Rules › Workspaces

### Add Federation Rule Workspace

`$client->organization->federation->rules->workspaces->add(string federationRuleID, string workspaceID): FederationRuleWorkspace`

**POST** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Enable a federation rule for a workspace.

Idempotent; re-enabling returns the existing enablement. The rule and
workspace must both belong to your organization. Membership of the
rule's target service account in this workspace is not checked at
enablement: token exchange into this workspace is rejected unless the
target is a member (it is implicitly a member of the default workspace).
Archived rules are rejected with 400. OAuth callers may only manage rules
whose `oauth_scope` is `workspace:developer` or `workspace:inference`;
other scopes require a Console session.

#### Parameters

- `federationRuleID: string` (path parameter)

  ID of the federation rule.

- `workspaceID: string`

  Tagged ID of the workspace to enable this rule for.

#### Returns

- `class FederationRuleWorkspace`

  - `"federation_rule_workspace" type`

  - `\Datetime createdAt`

    When this workspace was enabled for the rule.

  - `?string createdByActorID`

    Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.

  - `string federationRuleID`

    Tagged ID of the federation rule.

  - `string workspaceID`

    Tagged ID of the workspace this rule is enabled for.

  - `?string workspaceName`

    Workspace display name. Populated when listing; null in the enable response.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationRuleWorkspace = $client
  ->organization
  ->federation
  ->rules
  ->workspaces
  ->add('federation_rule_id', workspaceID: 'workspace_id');

var_dump($federationRuleWorkspace);
```

##### Response (200)

```json
{
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "federation_rule_id": "federation_rule_id",
  "type": "federation_rule_workspace",
  "workspace_id": "workspace_id",
  "workspace_name": "workspace_name"
}
```

### List Federation Rule Workspaces

`$client->organization->federation->rules->workspaces->list(string federationRuleID, ?int limit, ?string page): PageCursor<FederationRuleWorkspace>`

**GET** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

List workspaces where this federation rule is enabled.

Returns all workspace enablements in a single response; the `limit` and
`page` parameters are accepted but have no effect, and `next_page` is
always `null`. Returns explicit per-workspace enablements only; for
rules with `applies_to_all_workspaces` or a legacy single
`workspace_id`, check those fields on the rule itself.

#### Parameters

- `federationRuleID: string` (path parameter)

  ID of the federation rule.

- `limit?:optional int` (query parameter)

  Number of results per page.

  default: 20

- `page?:optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class FederationRuleWorkspace`

  - `"federation_rule_workspace" type`

  - `\Datetime createdAt`

    When this workspace was enabled for the rule.

  - `?string createdByActorID`

    Tagged ID (`user_...` or `svac_...`) of the actor that enabled this workspace for the rule, if known.

  - `string federationRuleID`

    Tagged ID of the federation rule.

  - `string workspaceID`

    Tagged ID of the workspace this rule is enabled for.

  - `?string workspaceName`

    Workspace display name. Populated when listing; null in the enable response.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->federation->rules->workspaces->list(
  'federation_rule_id', limit: 1, page: 'page'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by_actor_id": "created_by_actor_id",
      "federation_rule_id": "federation_rule_id",
      "type": "federation_rule_workspace",
      "workspace_id": "workspace_id",
      "workspace_name": "workspace_name"
    }
  ],
  "next_page": "next_page"
}
```

### Remove Federation Rule Workspace

`$client->organization->federation->rules->workspaces->remove(string workspaceID, string federationRuleID): WorkspaceRemoveResponse`

**DELETE** `/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Disable a federation rule for a workspace.

Idempotent; succeeds even if the enablement was already removed. OAuth
callers may only manage rules whose `oauth_scope` is
`workspace:developer` or `workspace:inference`; other scopes require a
Console session.

#### Parameters

- `federationRuleID: string` (path parameter)

  ID of the federation rule.

- `workspaceID: string` (path parameter)

  ID of the workspace to disable for.

#### Returns

- `class WorkspaceRemoveResponse`

  - `"federation_rule_workspace_deleted" type`

  - `string federationRuleID`

    Tagged ID of the federation rule.

  - `string workspaceID`

    Tagged ID of the workspace named in the delete request. Removal is idempotent.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspace = $client->organization->federation->rules->workspaces->remove(
  'workspace_id', federationRuleID: 'federation_rule_id'
);

var_dump($workspace);
```

##### Response (200)

```json
{
  "federation_rule_id": "federation_rule_id",
  "type": "federation_rule_workspace_deleted",
  "workspace_id": "workspace_id"
}
```

## Organization › Invites

### Create Invite

`$client->organization->invites->create(string email, Role role, ?list<string> rbacGroupIDs): OrganizationInvite`

**POST** `/v1/organizations/invites`

Invite a user to join the organization by email.

On plans that draw members from a finite pool of purchased seats, the invite automatically consumes a seat from the lowest tier with availability; there is no seat-tier parameter. When no seat is free the request fails with a 400 error rather than purchasing a seat.

#### Parameters

- `email: string`

  Email of the User.

- `role: Role`

  Role for the invited User.

  The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations accept `user` and `managed`; inviting with the `managed` role requires the `write:rbac_groups` scope in addition to `write:members`.

- `rbacGroupIDs?:optional list<string>`

  RBAC group IDs to assign to the User when the Invite is accepted. A non-empty array is accepted only for a Claude Enterprise organization with RBAC groups, and requires the key to carry the `write:rbac_groups` scope.

#### Returns

- `class OrganizationInvite`

  - `"invite" type`

    Object type.

    For Invites, this is always `"invite"`.

  - `string id`

    ID of the Invite.

  - `?\Datetime acceptedAt`

    RFC 3339 datetime string indicating when the Invite was accepted, or null.

  - `string email`

    Email of the User being invited.

  - `\Datetime expiresAt`

    RFC 3339 datetime string indicating when the Invite expires.

  - `\Datetime invitedAt`

    RFC 3339 datetime string indicating when the Invite was created.

  - `list<string> rbacGroupIDs`

    RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.

  - `OrganizationRole role`

    Organization role of the User.

  - `Status status`

    Status of the Invite.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$organizationInvite = $client->organization->invites->create(
  email: 'user@emaildomain.com', role: 'user', rbacGroupIDs: ['string']
);

var_dump($organizationInvite);
```

##### Response (200)

```json
{
  "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
  "accepted_at": "2019-12-27T18:11:19.117Z",
  "email": "user@emaildomain.com",
  "expires_at": "2024-11-20T23:58:27.427722Z",
  "invited_at": "2024-10-30T23:58:27.427722Z",
  "rbac_group_ids": [
    "string"
  ],
  "role": "admin",
  "status": "pending",
  "type": "invite"
}
```

### List Invites

`$client->organization->invites->list(?string afterID, ?string beforeID, ?string email, ?int limit, ?list<string> roles, ?list<Status> statuses): Page<OrganizationInvite>`

**GET** `/v1/organizations/invites`

List the organization's invites.

#### Parameters

- `afterID?:optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.

- `beforeID?:optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.

- `email?:optional string` (query parameter)

  Filter by the email address the Invite was sent to. Matches the same way as the Users list's `email` filter (normalized, case-insensitive).

- `limit?:optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

- `roles?:optional list<string>` (query parameter)

  Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together.

  Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`.

- `statuses?:optional list<Status>` (query parameter)

  Filter by Invite status. Repeatable; values are OR'ed together. Omit to return `pending`, `accepted`, and `expired` Invites alike.

#### Returns

- `class OrganizationInvite`

  - `"invite" type`

    Object type.

    For Invites, this is always `"invite"`.

  - `string id`

    ID of the Invite.

  - `?\Datetime acceptedAt`

    RFC 3339 datetime string indicating when the Invite was accepted, or null.

  - `string email`

    Email of the User being invited.

  - `\Datetime expiresAt`

    RFC 3339 datetime string indicating when the Invite expires.

  - `\Datetime invitedAt`

    RFC 3339 datetime string indicating when the Invite was created.

  - `list<string> rbacGroupIDs`

    RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.

  - `OrganizationRole role`

    Organization role of the User.

  - `Status status`

    Status of the Invite.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->invites->list(
  afterID: 'after_id',
  beforeID: 'before_id',
  email: 'dev@stainless.com',
  limit: 1,
  roles: ['string'],
  statuses: ['accepted'],
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
      "accepted_at": "2019-12-27T18:11:19.117Z",
      "email": "user@emaildomain.com",
      "expires_at": "2024-11-20T23:58:27.427722Z",
      "invited_at": "2024-10-30T23:58:27.427722Z",
      "rbac_group_ids": [
        "string"
      ],
      "role": "admin",
      "status": "pending",
      "type": "invite"
    }
  ],
  "first_id": "first_id",
  "has_more": true,
  "last_id": "last_id"
}
```

### Get Invite

`$client->organization->invites->retrieve(string inviteID): OrganizationInvite`

**GET** `/v1/organizations/invites/{invite_id}`

Retrieve an invite by ID.

#### Parameters

- `inviteID: string` (path parameter)

  ID of the Invite.

#### Returns

- `class OrganizationInvite`

  - `"invite" type`

    Object type.

    For Invites, this is always `"invite"`.

  - `string id`

    ID of the Invite.

  - `?\Datetime acceptedAt`

    RFC 3339 datetime string indicating when the Invite was accepted, or null.

  - `string email`

    Email of the User being invited.

  - `\Datetime expiresAt`

    RFC 3339 datetime string indicating when the Invite expires.

  - `\Datetime invitedAt`

    RFC 3339 datetime string indicating when the Invite was created.

  - `list<string> rbacGroupIDs`

    RBAC group IDs recorded on the Invite (Claude Enterprise organizations), to be assigned to the User when the Invite is accepted. `[]` when none.

  - `OrganizationRole role`

    Organization role of the User.

  - `Status status`

    Status of the Invite.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$organizationInvite = $client->organization->invites->retrieve('invite_id');

var_dump($organizationInvite);
```

##### Response (200)

```json
{
  "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
  "accepted_at": "2019-12-27T18:11:19.117Z",
  "email": "user@emaildomain.com",
  "expires_at": "2024-11-20T23:58:27.427722Z",
  "invited_at": "2024-10-30T23:58:27.427722Z",
  "rbac_group_ids": [
    "string"
  ],
  "role": "admin",
  "status": "pending",
  "type": "invite"
}
```

### Delete Invite

`$client->organization->invites->delete(string inviteID): InviteDeleteResponse`

**DELETE** `/v1/organizations/invites/{invite_id}`

Delete a pending invite.

#### Parameters

- `inviteID: string` (path parameter)

  ID of the Invite.

#### Returns

- `class InviteDeleteResponse`

  - `"invite_deleted" type`

    Deleted object type.

    For Invites, this is always `"invite_deleted"`.

  - `string id`

    ID of the Invite.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$invite = $client->organization->invites->delete('invite_id');

var_dump($invite);
```

##### Response (200)

```json
{
  "id": "invite_015gWxCN9Hfg2QhZwTK7Mdeu",
  "type": "invite_deleted"
}
```

## Organization › Service Accounts

### Create Service Account

`$client->organization->serviceAccounts->create(string name, ?string description, ?OrganizationRole organizationRole): ServiceAccount`

**POST** `/v1/organizations/service_accounts`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Create a service account.

A service account is a named workload identity that federation rules
target. `organization_role` is `developer` (default) or `admin`; a rule
may only be created or retargeted to grant `org:admin` scope when the
target's `organization_role` is `admin`. Creating an `admin`-role service
account requires an interactive credential (a user OAuth token or a
Console session) — a workload may only create `developer`-role service
accounts.

#### Parameters

- `name: string`

  Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

- `description?:optional string`

  Optional free-text description.

- `organizationRole?:optional OrganizationRole`

  Org-level role. Defaults to `developer`.

#### Returns

- `class ServiceAccount`

  - `"service_account" type`

  - `string id`

    Tagged ID of the service account.

  - `?\Datetime archivedAt`

    If set, this service account is archived.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.

  - `\Datetime createdAt`

    When this service account was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this service account.

  - `?string description`

    Optional free-text description.

  - `string name`

    Admin-chosen slug identifier.

  - `OrganizationRole organizationRole`

    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.

  - `\Datetime updatedAt`

    When this service account was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccount = $client->organization->serviceAccounts->create(
  name: 'ci-deploy-bot', description: 'description', organizationRole: 'admin'
);

var_dump($serviceAccount);
```

##### Response (200)

```json
{
  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "name": "ci-deploy-bot",
  "organization_role": "admin",
  "type": "service_account",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

### List Service Accounts

`$client->organization->serviceAccounts->list(?bool includeArchived, ?int limit, ?string page): PageCursor<ServiceAccount>`

**GET** `/v1/organizations/service_accounts`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

List service accounts in the caller's organization.

Results are ordered by creation time, newest first. Use `limit` and the
`next_page` cursor to paginate; set `include_archived=true` to include
archived service accounts.

#### Parameters

- `includeArchived?:optional bool` (query parameter)

  Include archived resources. Defaults to false.

  default: false

- `limit?:optional int` (query parameter)

  Number of results per page.

  default: 20

- `page?:optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class ServiceAccount`

  - `"service_account" type`

  - `string id`

    Tagged ID of the service account.

  - `?\Datetime archivedAt`

    If set, this service account is archived.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.

  - `\Datetime createdAt`

    When this service account was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this service account.

  - `?string description`

    Optional free-text description.

  - `string name`

    Admin-chosen slug identifier.

  - `OrganizationRole organizationRole`

    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.

  - `\Datetime updatedAt`

    When this service account was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->serviceAccounts->list(
  includeArchived: true, limit: 1, page: 'page'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
      "archived_at": "2019-12-27T18:11:19.117Z",
      "archived_by_actor_id": "archived_by_actor_id",
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by_actor_id": "created_by_actor_id",
      "description": "description",
      "name": "ci-deploy-bot",
      "organization_role": "admin",
      "type": "service_account",
      "updated_at": "2024-10-30T23:58:27.427722Z",
      "updated_by_actor_id": "updated_by_actor_id"
    }
  ],
  "next_page": "next_page"
}
```

### Get Service Account

`$client->organization->serviceAccounts->retrieve(string serviceAccountID): ServiceAccount`

**GET** `/v1/organizations/service_accounts/{service_account_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Retrieve a service account by its ID (`svac_...`).

#### Parameters

- `serviceAccountID: string` (path parameter)

  ID of the service account.

#### Returns

- `class ServiceAccount`

  - `"service_account" type`

  - `string id`

    Tagged ID of the service account.

  - `?\Datetime archivedAt`

    If set, this service account is archived.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.

  - `\Datetime createdAt`

    When this service account was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this service account.

  - `?string description`

    Optional free-text description.

  - `string name`

    Admin-chosen slug identifier.

  - `OrganizationRole organizationRole`

    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.

  - `\Datetime updatedAt`

    When this service account was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccount = $client->organization->serviceAccounts->retrieve(
  'service_account_id'
);

var_dump($serviceAccount);
```

##### Response (200)

```json
{
  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "name": "ci-deploy-bot",
  "organization_role": "admin",
  "type": "service_account",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

### Update Service Account

`$client->organization->serviceAccounts->update(string serviceAccountID, ?string description, ?OrganizationRole organizationRole): ServiceAccount`

**POST** `/v1/organizations/service_accounts/{service_account_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Update a service account.

Only `description` and `organization_role` are mutable; `name` cannot be
changed. Archived service accounts cannot be updated; this returns 400.
Setting `organization_role` to `admin` (even when unchanged) requires an
interactive credential (a user OAuth token or a Console session).

#### Parameters

- `serviceAccountID: string` (path parameter)

  ID of the service account to update.

- `description?:optional string`

  Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string).

- `organizationRole?:optional OrganizationRole`

  Replaces the org-level role. Omit or send `null` to leave unchanged.

#### Returns

- `class ServiceAccount`

  - `"service_account" type`

  - `string id`

    Tagged ID of the service account.

  - `?\Datetime archivedAt`

    If set, this service account is archived.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.

  - `\Datetime createdAt`

    When this service account was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this service account.

  - `?string description`

    Optional free-text description.

  - `string name`

    Admin-chosen slug identifier.

  - `OrganizationRole organizationRole`

    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.

  - `\Datetime updatedAt`

    When this service account was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccount = $client->organization->serviceAccounts->update(
  'service_account_id', description: 'description', organizationRole: 'admin'
);

var_dump($serviceAccount);
```

##### Response (200)

```json
{
  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "name": "ci-deploy-bot",
  "organization_role": "admin",
  "type": "service_account",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

### Archive Service Account

`$client->organization->serviceAccounts->archive(string serviceAccountID): ServiceAccount`

**POST** `/v1/organizations/service_accounts/{service_account_id}/archive`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Archive a service account.

Idempotent; re-archiving returns the service account with its original
`archived_at`. Rejected with 400 if any live (non-archived) federation
rule still targets this service account, same as issuer archival; archive
those rules first or change their target to another service account.

#### Parameters

- `serviceAccountID: string` (path parameter)

  ID of the service account to archive.

#### Returns

- `class ServiceAccount`

  - `"service_account" type`

  - `string id`

    Tagged ID of the service account.

  - `?\Datetime archivedAt`

    If set, this service account is archived.

  - `?string archivedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that archived this service account.

  - `\Datetime createdAt`

    When this service account was created.

  - `?string createdByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that created this service account.

  - `?string description`

    Optional free-text description.

  - `string name`

    Admin-chosen slug identifier.

  - `OrganizationRole organizationRole`

    Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console.

  - `\Datetime updatedAt`

    When this service account was last updated.

  - `?string updatedByActorID`

    Tagged ID (`user_`/`svac_`) of the actor that last updated this service account.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccount = $client->organization->serviceAccounts->archive(
  'service_account_id'
);

var_dump($serviceAccount);
```

##### Response (200)

```json
{
  "id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "name": "ci-deploy-bot",
  "organization_role": "admin",
  "type": "service_account",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id"
}
```

## Organization › Service Accounts › Workspaces

### Add Workspace To Service Account

`$client->organization->serviceAccounts->workspaces->add(string serviceAccountID, string workspaceID, NoBillingWorkspaceRole workspaceRole): ServiceAccountWorkspaceMember`

**POST** `/v1/organizations/service_accounts/{service_account_id}/workspaces`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Add a service account to a workspace with the given `workspace_role`.

Mirror of `POST /workspaces/{workspace_id}/service_accounts`, addressed
from the service-account side; both create the same membership. If the
service account is already an explicit member of the workspace, its
`workspace_role` is replaced with the value supplied here. Archived
workspaces return 400. Archived service accounts cannot be added and are
rejected.

#### Parameters

- `serviceAccountID: string` (path parameter)

  ID of the service account.

- `workspaceID: string`

  Tagged workspace ID to add the service account to.

- `workspaceRole: NoBillingWorkspaceRole`

  Role to assign to the service account in this workspace.

#### Returns

- `class ServiceAccountWorkspaceMember`

  - `"service_account_workspace_member" type`

  - `?string createdByActorID`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `?bool implicit`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`).

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole workspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Workspaces\NoBillingWorkspaceRole;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccountWorkspaceMember = $client
  ->organization
  ->serviceAccounts
  ->workspaces
  ->add(
  'service_account_id',
  workspaceID: 'workspace_id',
  workspaceRole: NoBillingWorkspaceRole::WORKSPACE_ADMIN,
);

var_dump($serviceAccountWorkspaceMember);
```

##### Response (200)

```json
{
  "created_by_actor_id": "created_by_actor_id",
  "implicit": true,
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member",
  "workspace_id": "workspace_id",
  "workspace_role": "workspace_admin"
}
```

### List Workspaces For Service Account

`$client->organization->serviceAccounts->workspaces->list(string serviceAccountID, ?int limit, ?string page): PageCursor<ServiceAccountWorkspaceMember>`

**GET** `/v1/organizations/service_accounts/{service_account_id}/workspaces`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

List the workspaces a service account is a member of.

Each entry includes the service account's `workspace_role` in that
workspace. Use `limit` and the `next_page` cursor to paginate. When the
service account has no explicit default-workspace membership, the
implicit (`implicit: true`) membership is returned as the first entry on
the first page; with `limit=1` the first page may return up to 2 entries
(the implicit entry plus one explicit membership) so a pagination cursor
can be derived. Memberships are returned only while
the service account is active. Without a `page` cursor, an archived
service account returns an empty list. A `page` cursor that does not
match an active membership returns a 400 invalid-request error. A cursor
stops matching when the membership is removed, the workspace is deleted,
or the service account is archived. Restart pagination from the first
page to recover.

#### Parameters

- `serviceAccountID: string` (path parameter)

  ID of the service account.

- `limit?:optional int` (query parameter)

  Number of results per page.

  default: 20

- `page?:optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class ServiceAccountWorkspaceMember`

  - `"service_account_workspace_member" type`

  - `?string createdByActorID`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `?bool implicit`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`).

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole workspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->serviceAccounts->workspaces->list(
  'service_account_id', limit: 1, page: 'page'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "created_by_actor_id": "created_by_actor_id",
      "implicit": true,
      "service_account_id": "service_account_id",
      "type": "service_account_workspace_member",
      "workspace_id": "workspace_id",
      "workspace_role": "workspace_admin"
    }
  ],
  "next_page": "next_page"
}
```

### Remove Workspace From Service Account

`$client->organization->serviceAccounts->workspaces->remove(string workspaceID, string serviceAccountID): WorkspaceRemoveResponse`

**DELETE** `/v1/organizations/service_accounts/{service_account_id}/workspaces/{workspace_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Remove a service account from a workspace.

Mirror of `DELETE /workspaces/{workspace_id}/service_accounts/{service_account_id}`,
addressed from the service-account side. Removal is idempotent (returns
200 even if the membership was already removed). A DELETE against the
implicit default-workspace membership returns 200 but is a no-op and the
membership persists; deleting an explicit default-workspace row reverts
to the implicit `workspace_user` membership. Archived workspaces return
400.

#### Parameters

- `serviceAccountID: string` (path parameter)

  ID of the service account.

- `workspaceID: string` (path parameter)

  ID of the workspace.

#### Returns

- `class WorkspaceRemoveResponse`

  - `"service_account_workspace_member_deleted" type`

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op.

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`) named in the delete request.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspace = $client->organization->serviceAccounts->workspaces->remove(
  'workspace_id', serviceAccountID: 'service_account_id'
);

var_dump($workspace);
```

##### Response (200)

```json
{
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member_deleted",
  "workspace_id": "workspace_id"
}
```

## Organization › Users

### List Users

`$client->organization->users->list(?string afterID, ?string beforeID, ?string email, ?int limit, ?list<string> roles): Page<OrganizationUser>`

**GET** `/v1/organizations/users`

List the organization's members.

#### Parameters

- `afterID?:optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.

- `beforeID?:optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.

- `email?:optional string` (query parameter)

  Filter by user email.

- `limit?:optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

- `roles?:optional list<string>` (query parameter)

  Filter to items whose `role` equals one of the supplied values. Repeatable; values are OR'ed together.

  Accepted values depend on the organization type: Console and API organizations accept `user`, `developer`, `billing`, `admin`, and `claude_code_user`; Claude Enterprise organizations accept `user`, `owner`, `primary_owner`, `membership_admin`, and `managed`.

#### Returns

- `class OrganizationUser`

  - `"user" type`

    Object type.

    For Users, this is always `"user"`.

  - `string id`

    ID of the User.

  - `\Datetime addedAt`

    RFC 3339 datetime string indicating when the User joined the Organization.

  - `string email`

    Email of the User.

  - `string name`

    Name of the User.

  - `OrganizationRole role`

    Organization role of the User.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->users->list(
  afterID: 'after_id',
  beforeID: 'before_id',
  email: 'dev@stainless.com',
  limit: 1,
  roles: ['string'],
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
      "added_at": "2024-10-30T23:58:27.427722Z",
      "email": "user@emaildomain.com",
      "name": "Jane Doe",
      "role": "admin",
      "type": "user"
    }
  ],
  "first_id": "first_id",
  "has_more": true,
  "last_id": "last_id"
}
```

### Get User

`$client->organization->users->retrieve(string userID): OrganizationUser`

**GET** `/v1/organizations/users/{user_id}`

Retrieve a member of the organization by user ID.

#### Parameters

- `userID: string` (path parameter)

  ID of the User.

#### Returns

- `class OrganizationUser`

  - `"user" type`

    Object type.

    For Users, this is always `"user"`.

  - `string id`

    ID of the User.

  - `\Datetime addedAt`

    RFC 3339 datetime string indicating when the User joined the Organization.

  - `string email`

    Email of the User.

  - `string name`

    Name of the User.

  - `OrganizationRole role`

    Organization role of the User.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$organizationUser = $client->organization->users->retrieve('user_id');

var_dump($organizationUser);
```

##### Response (200)

```json
{
  "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
  "added_at": "2024-10-30T23:58:27.427722Z",
  "email": "user@emaildomain.com",
  "name": "Jane Doe",
  "role": "admin",
  "type": "user"
}
```

### Update User

`$client->organization->users->update(string userID, Role role): OrganizationUser`

**POST** `/v1/organizations/users/{user_id}`

Update a member's organization role.

#### Parameters

- `userID: string` (path parameter)

  ID of the User.

- `role: Role`

  New role for the User.

  The accepted values depend on the organization type. Console and API organizations accept `user`, `developer`, `billing`, and `claude_code_user`; `admin` cannot be assigned through the API. Claude Enterprise organizations accept `user` and `managed`; changing a User's role to `managed` requires the `write:rbac_groups` scope in addition to `write:members`.

#### Returns

- `class OrganizationUser`

  - `"user" type`

    Object type.

    For Users, this is always `"user"`.

  - `string id`

    ID of the User.

  - `\Datetime addedAt`

    RFC 3339 datetime string indicating when the User joined the Organization.

  - `string email`

    Email of the User.

  - `string name`

    Name of the User.

  - `OrganizationRole role`

    Organization role of the User.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$organizationUser = $client->organization->users->update(
  'user_id', role: 'user'
);

var_dump($organizationUser);
```

##### Response (200)

```json
{
  "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
  "added_at": "2024-10-30T23:58:27.427722Z",
  "email": "user@emaildomain.com",
  "name": "Jane Doe",
  "role": "admin",
  "type": "user"
}
```

### Remove User

`$client->organization->users->remove(string userID): UserRemoveResponse`

**DELETE** `/v1/organizations/users/{user_id}`

Remove a member from the organization.

#### Parameters

- `userID: string` (path parameter)

  ID of the User.

#### Returns

- `class UserRemoveResponse`

  - `"user_deleted" type`

    Deleted object type.

    For Users, this is always `"user_deleted"`.

  - `string id`

    ID of the User.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$user = $client->organization->users->remove('user_id');

var_dump($user);
```

##### Response (200)

```json
{
  "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
  "type": "user_deleted"
}
```

## Organization › Workspaces

### List Workspaces

`$client->organization->workspaces->list(?string afterID, ?string beforeID, ?bool includeArchived, ?bool includeDefault, ?int limit): Page<Workspace>`

**GET** `/v1/organizations/workspaces`

List Workspaces

#### Parameters

- `afterID?:optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.

- `beforeID?:optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.

- `includeArchived?:optional bool` (query parameter)

  Whether to include Workspaces that have been archived in the response

  default: false

- `includeDefault?:optional bool` (query parameter)

  Whether to include the organization's default Workspace in the response

  default: false

- `limit?:optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

#### Returns

- `class Workspace`

  - `"workspace" type`

    Object type.

    For Workspaces, this is always `"workspace"`.

  - `string id`

    ID of the Workspace.

  - `?\Datetime archivedAt`

    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.

  - `string compartmentID`

    Identifier for this Workspace's encryption compartment. When you configure a
    customer-managed encryption key (CMEK) on AWS, reference this value in your
    KMS key-policy condition so the key is scoped to this compartment. On GCP and
    Azure, Anthropic enforces the compartment binding automatically; you do not
    need to reference this value in your key configuration. See the CMEK
    integration guide for the required key configuration; unless your organization
    is on Claude Platform on AWS, it includes a separate value used during key
    validation. On Claude Platform on AWS there is no separate validation value:
    the key is validated against this Workspace's own value when it is attached, so
    if your key policy uses the compartment condition, add this value to it before
    attaching the key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the Workspace was created.

  - `DataResidency dataResidency`

    Data residency configuration.

  - `string displayColor`

    Hex color code representing the Workspace in the Anthropic Console.

  - `?string externalKeyID`

    ID of the customer-managed encryption key (CMEK) configuration to use for this
    Workspace. Setting this field requires CMEK to be enabled for your
    organization. When set, data stored for this Workspace is encrypted with the
    referenced key. Create key configurations with the External Keys API. On
    Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
    single-Region key in the same AWS account and Region as the Workspace. On that
    platform the key is validated against this Workspace when it is attached, so a
    key-policy problem is reported as an error on this request. This field is write-once:
    once a key is attached to a Workspace it cannot be detached or replaced. To
    rotate key material, rotate the underlying key on your cloud KMS; the
    `external_key_id` stays the same.

  - `string name`

    Name of the Workspace.

  - `array<string,string> tags`

    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->workspaces->list(
  afterID: 'after_id',
  beforeID: 'before_id',
  includeArchived: true,
  includeDefault: true,
  limit: 1,
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
      "archived_at": "2024-11-01T23:59:27.427722Z",
      "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",
      "created_at": "2024-10-30T23:58:27.427722Z",
      "data_residency": {
        "allowed_inference_geos": "unrestricted",
        "default_inference_geo": "global",
        "workspace_geo": "us"
      },
      "display_color": "#6C5BB9",
      "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
      "name": "Workspace Name",
      "tags": {
        "env": "prod",
        "team": "platform"
      },
      "type": "workspace"
    }
  ],
  "first_id": "first_id",
  "has_more": true,
  "last_id": "last_id"
}
```

### Create Workspace

`$client->organization->workspaces->create(string name, ?DataResidencyCreateConfig dataResidency, ?string displayColor, ?string externalKeyID, ?array<string,string> tags): Workspace`

**POST** `/v1/organizations/workspaces`

Create Workspace

#### Parameters

- `name: string`

  Name of the Workspace.

- `dataResidency?:optional DataResidencyCreateConfig`

  Data residency configuration for the workspace. If omitted, defaults to `workspace_geo: "us"`, `allowed_inference_geos: "unrestricted"`, and `default_inference_geo: "global"`.

- `displayColor?:optional string`

  Hex color code representing the Workspace in the Anthropic Console.

- `externalKeyID?:optional string`

  ID of the customer-managed encryption key (CMEK) configuration to use for this
  Workspace. Setting this field requires CMEK to be enabled for your
  organization. When set, data stored for this Workspace is encrypted with the
  referenced key. Create key configurations with the External Keys API. On
  Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
  single-Region key in the same AWS account and Region as the Workspace. On that
  platform the key is validated against this Workspace when it is attached, so a
  key-policy problem is reported as an error on this request. This field is write-once:
  once a key is attached to a Workspace it cannot be detached or replaced. To
  rotate key material, rotate the underlying key on your cloud KMS; the
  `external_key_id` stays the same.

- `tags?:optional array<string,string>`

  User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.

#### Returns

- `class Workspace`

  - `"workspace" type`

    Object type.

    For Workspaces, this is always `"workspace"`.

  - `string id`

    ID of the Workspace.

  - `?\Datetime archivedAt`

    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.

  - `string compartmentID`

    Identifier for this Workspace's encryption compartment. When you configure a
    customer-managed encryption key (CMEK) on AWS, reference this value in your
    KMS key-policy condition so the key is scoped to this compartment. On GCP and
    Azure, Anthropic enforces the compartment binding automatically; you do not
    need to reference this value in your key configuration. See the CMEK
    integration guide for the required key configuration; unless your organization
    is on Claude Platform on AWS, it includes a separate value used during key
    validation. On Claude Platform on AWS there is no separate validation value:
    the key is validated against this Workspace's own value when it is attached, so
    if your key policy uses the compartment condition, add this value to it before
    attaching the key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the Workspace was created.

  - `DataResidency dataResidency`

    Data residency configuration.

  - `string displayColor`

    Hex color code representing the Workspace in the Anthropic Console.

  - `?string externalKeyID`

    ID of the customer-managed encryption key (CMEK) configuration to use for this
    Workspace. Setting this field requires CMEK to be enabled for your
    organization. When set, data stored for this Workspace is encrypted with the
    referenced key. Create key configurations with the External Keys API. On
    Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
    single-Region key in the same AWS account and Region as the Workspace. On that
    platform the key is validated against this Workspace when it is attached, so a
    key-policy problem is reported as an error on this request. This field is write-once:
    once a key is attached to a Workspace it cannot be detached or replaced. To
    rotate key material, rotate the underlying key on your cloud KMS; the
    `external_key_id` stays the same.

  - `string name`

    Name of the Workspace.

  - `array<string,string> tags`

    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspace = $client->organization->workspaces->create(
  name: 'x',
  dataResidency: [
    'allowedInferenceGeos' => 'unrestricted',
    'defaultInferenceGeo' => 'global',
    'workspaceGeo' => 'us',
  ],
  displayColor: '#6C5BB9',
  externalKeyID: 'ekey_01SDCCSbTxrXDpWc1phhtcfK',
  tags: ['env' => 'prod', 'team' => 'platform'],
);

var_dump($workspace);
```

##### Response (200)

```json
{
  "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
  "archived_at": "2024-11-01T23:59:27.427722Z",
  "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "data_residency": {
    "allowed_inference_geos": "unrestricted",
    "default_inference_geo": "global",
    "workspace_geo": "us"
  },
  "display_color": "#6C5BB9",
  "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "name": "Workspace Name",
  "tags": {
    "env": "prod",
    "team": "platform"
  },
  "type": "workspace"
}
```

### Get Workspace

`$client->organization->workspaces->retrieve(string workspaceID): Workspace`

**GET** `/v1/organizations/workspaces/{workspace_id}`

Get Workspace

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the Workspace.

#### Returns

- `class Workspace`

  - `"workspace" type`

    Object type.

    For Workspaces, this is always `"workspace"`.

  - `string id`

    ID of the Workspace.

  - `?\Datetime archivedAt`

    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.

  - `string compartmentID`

    Identifier for this Workspace's encryption compartment. When you configure a
    customer-managed encryption key (CMEK) on AWS, reference this value in your
    KMS key-policy condition so the key is scoped to this compartment. On GCP and
    Azure, Anthropic enforces the compartment binding automatically; you do not
    need to reference this value in your key configuration. See the CMEK
    integration guide for the required key configuration; unless your organization
    is on Claude Platform on AWS, it includes a separate value used during key
    validation. On Claude Platform on AWS there is no separate validation value:
    the key is validated against this Workspace's own value when it is attached, so
    if your key policy uses the compartment condition, add this value to it before
    attaching the key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the Workspace was created.

  - `DataResidency dataResidency`

    Data residency configuration.

  - `string displayColor`

    Hex color code representing the Workspace in the Anthropic Console.

  - `?string externalKeyID`

    ID of the customer-managed encryption key (CMEK) configuration to use for this
    Workspace. Setting this field requires CMEK to be enabled for your
    organization. When set, data stored for this Workspace is encrypted with the
    referenced key. Create key configurations with the External Keys API. On
    Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
    single-Region key in the same AWS account and Region as the Workspace. On that
    platform the key is validated against this Workspace when it is attached, so a
    key-policy problem is reported as an error on this request. This field is write-once:
    once a key is attached to a Workspace it cannot be detached or replaced. To
    rotate key material, rotate the underlying key on your cloud KMS; the
    `external_key_id` stays the same.

  - `string name`

    Name of the Workspace.

  - `array<string,string> tags`

    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspace = $client->organization->workspaces->retrieve('workspace_id');

var_dump($workspace);
```

##### Response (200)

```json
{
  "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
  "archived_at": "2024-11-01T23:59:27.427722Z",
  "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "data_residency": {
    "allowed_inference_geos": "unrestricted",
    "default_inference_geo": "global",
    "workspace_geo": "us"
  },
  "display_color": "#6C5BB9",
  "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "name": "Workspace Name",
  "tags": {
    "env": "prod",
    "team": "platform"
  },
  "type": "workspace"
}
```

### Update Workspace

`$client->organization->workspaces->update(string workspaceID, ?DataResidencyUpdateConfig dataResidency, ?string displayColor, ?string externalKeyID, ?string name, ?array<string,string> tags): Workspace`

**POST** `/v1/organizations/workspaces/{workspace_id}`

Update Workspace

#### Parameters

- `workspaceID: string` (path parameter)

- `dataResidency?:optional DataResidencyUpdateConfig`

  Data residency configuration for the workspace.

- `displayColor?:optional string`

  Hex color code representing the Workspace in the Anthropic Console.

- `externalKeyID?:optional string`

  ID of the customer-managed encryption key (CMEK) configuration to use for this
  Workspace. Setting this field requires CMEK to be enabled for your
  organization. When set, data stored for this Workspace is encrypted with the
  referenced key. Create key configurations with the External Keys API. On
  Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
  single-Region key in the same AWS account and Region as the Workspace. On that
  platform the key is validated against this Workspace when it is attached, so a
  key-policy problem is reported as an error on this request. This field is write-once:
  once a key is attached to a Workspace it cannot be detached or replaced. To
  rotate key material, rotate the underlying key on your cloud KMS; the
  `external_key_id` stays the same.

- `name?:optional string`

  Name of the Workspace.

- `tags?:optional array<string,string>`

  User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.

#### Returns

- `class Workspace`

  - `"workspace" type`

    Object type.

    For Workspaces, this is always `"workspace"`.

  - `string id`

    ID of the Workspace.

  - `?\Datetime archivedAt`

    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.

  - `string compartmentID`

    Identifier for this Workspace's encryption compartment. When you configure a
    customer-managed encryption key (CMEK) on AWS, reference this value in your
    KMS key-policy condition so the key is scoped to this compartment. On GCP and
    Azure, Anthropic enforces the compartment binding automatically; you do not
    need to reference this value in your key configuration. See the CMEK
    integration guide for the required key configuration; unless your organization
    is on Claude Platform on AWS, it includes a separate value used during key
    validation. On Claude Platform on AWS there is no separate validation value:
    the key is validated against this Workspace's own value when it is attached, so
    if your key policy uses the compartment condition, add this value to it before
    attaching the key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the Workspace was created.

  - `DataResidency dataResidency`

    Data residency configuration.

  - `string displayColor`

    Hex color code representing the Workspace in the Anthropic Console.

  - `?string externalKeyID`

    ID of the customer-managed encryption key (CMEK) configuration to use for this
    Workspace. Setting this field requires CMEK to be enabled for your
    organization. When set, data stored for this Workspace is encrypted with the
    referenced key. Create key configurations with the External Keys API. On
    Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
    single-Region key in the same AWS account and Region as the Workspace. On that
    platform the key is validated against this Workspace when it is attached, so a
    key-policy problem is reported as an error on this request. This field is write-once:
    once a key is attached to a Workspace it cannot be detached or replaced. To
    rotate key material, rotate the underlying key on your cloud KMS; the
    `external_key_id` stays the same.

  - `string name`

    Name of the Workspace.

  - `array<string,string> tags`

    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspace = $client->organization->workspaces->update(
  'workspace_id',
  dataResidency: [
    'allowedInferenceGeos' => 'unrestricted', 'defaultInferenceGeo' => 'global'
  ],
  displayColor: '#6C5BB9',
  externalKeyID: 'ekey_01SDCCSbTxrXDpWc1phhtcfK',
  name: 'x',
  tags: ['env' => 'prod', 'team' => 'platform'],
);

var_dump($workspace);
```

##### Response (200)

```json
{
  "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
  "archived_at": "2024-11-01T23:59:27.427722Z",
  "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "data_residency": {
    "allowed_inference_geos": "unrestricted",
    "default_inference_geo": "global",
    "workspace_geo": "us"
  },
  "display_color": "#6C5BB9",
  "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "name": "Workspace Name",
  "tags": {
    "env": "prod",
    "team": "platform"
  },
  "type": "workspace"
}
```

### Archive Workspace

`$client->organization->workspaces->archive(string workspaceID): Workspace`

**POST** `/v1/organizations/workspaces/{workspace_id}/archive`

Archive Workspace

#### Parameters

- `workspaceID: string` (path parameter)

#### Returns

- `class Workspace`

  - `"workspace" type`

    Object type.

    For Workspaces, this is always `"workspace"`.

  - `string id`

    ID of the Workspace.

  - `?\Datetime archivedAt`

    RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived.

  - `string compartmentID`

    Identifier for this Workspace's encryption compartment. When you configure a
    customer-managed encryption key (CMEK) on AWS, reference this value in your
    KMS key-policy condition so the key is scoped to this compartment. On GCP and
    Azure, Anthropic enforces the compartment binding automatically; you do not
    need to reference this value in your key configuration. See the CMEK
    integration guide for the required key configuration; unless your organization
    is on Claude Platform on AWS, it includes a separate value used during key
    validation. On Claude Platform on AWS there is no separate validation value:
    the key is validated against this Workspace's own value when it is attached, so
    if your key policy uses the compartment condition, add this value to it before
    attaching the key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the Workspace was created.

  - `DataResidency dataResidency`

    Data residency configuration.

  - `string displayColor`

    Hex color code representing the Workspace in the Anthropic Console.

  - `?string externalKeyID`

    ID of the customer-managed encryption key (CMEK) configuration to use for this
    Workspace. Setting this field requires CMEK to be enabled for your
    organization. When set, data stored for this Workspace is encrypted with the
    referenced key. Create key configurations with the External Keys API. On
    Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a
    single-Region key in the same AWS account and Region as the Workspace. On that
    platform the key is validated against this Workspace when it is attached, so a
    key-policy problem is reported as an error on this request. This field is write-once:
    once a key is attached to a Workspace it cannot be detached or replaced. To
    rotate key material, rotate the underlying key on your cloud KMS; the
    `external_key_id` stays the same.

  - `string name`

    Name of the Workspace.

  - `array<string,string> tags`

    User-defined tags as string key-value pairs. Keys may not begin with `anthropic`.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspace = $client->organization->workspaces->archive('workspace_id');

var_dump($workspace);
```

##### Response (200)

```json
{
  "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
  "archived_at": "2024-11-01T23:59:27.427722Z",
  "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "data_residency": {
    "allowed_inference_geos": "unrestricted",
    "default_inference_geo": "global",
    "workspace_geo": "us"
  },
  "display_color": "#6C5BB9",
  "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK",
  "name": "Workspace Name",
  "tags": {
    "env": "prod",
    "team": "platform"
  },
  "type": "workspace"
}
```

## Organization › Workspaces › Rate Limits

### List Workspace Rate Limits

`$client->organization->workspaces->rateLimits->list(string workspaceID, ?GroupType groupType, ?bool includeInherited, ?int limit, ?string page): PageCursor<WorkspaceRateLimit>`

**GET** `/v1/organizations/workspaces/{workspace_id}/rate_limits`

List a workspace's rate limits.

By default, returns only the groups and limiter types that have a
workspace-level override. With `include_inherited=true`, returns every
group with organization-level limits the workspace can see, listing for
each the values it inherits from the organization as well as its own
overrides. Each value's `source` says which it is.

When `limit` is omitted, every matching entry is returned in a single
page; when `limit` truncates the result, follow `next_page` to fetch
the remaining entries.

#### Parameters

- `workspaceID: string` (path parameter)

  The ID of the workspace.

- `groupType?:optional GroupType` (query parameter)

  Filter by group type.

- `includeInherited?:optional bool` (query parameter)

  Also list the limiter values the workspace inherits from the organization, including groups with no workspace-level override.

  default: false

- `limit?:optional int` (query parameter)

  Maximum number of items to return per page. Ranges from `1` to `1000`.

  When omitted, every remaining entry is returned in a single page and `next_page` is `null`.

- `page?:optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class WorkspaceRateLimit`

  - `"workspace_rate_limit" type`

    Object type. Always `workspace_rate_limit` for workspace rate-limit entries.

  - `Group group`

    The rate-limit group this entry's limits apply to.

  - `list<WorkspaceRateLimitValue> limits`

    The workspace's limiter values for this group. By default only the limiter types with a workspace-level override are listed. With `include_inherited` set to `true`, the limiter types the workspace inherits from the organization are listed too, each marked by `source`.

  - `?list<string> models`

    Model names this entry's limits apply to, including aliases. `null` when `group.type` is not `"model_group"`. The list covers the models this workspace has access to, so it can differ between workspaces.

  - `string rateLimitID`

    The `id` of the organization's RateLimit entry this entry applies to.

  - `string workspaceID`

    ID of the Workspace this entry applies to.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->workspaces->rateLimits->list(
  'workspace_id',
  groupType: 'batch',
  includeInherited: true,
  limit: 1,
  page: 'page',
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "group": {
        "id": "id",
        "display_name": "display_name",
        "type": "model_group"
      },
      "limits": [
        {
          "org_limit": 0,
          "source": {
            "type": "workspace"
          },
          "type": "type",
          "value": 0
        }
      ],
      "models": [
        "string"
      ],
      "rate_limit_id": "rate_limit_id",
      "type": "workspace_rate_limit",
      "workspace_id": "workspace_id"
    }
  ],
  "next_page": "next_page"
}
```

### Set Workspace Rate Limits

`$client->organization->workspaces->rateLimits->update(string rateLimitID, string workspaceID, list<WorkspaceRateLimitUpdateValue> limits): WorkspaceRateLimit`

**POST** `/v1/organizations/workspaces/{workspace_id}/rate_limits/{rate_limit_id}`

Set or clear rate-limit overrides for one rate-limit group in a workspace.

Only the limiter types named in `limits` change: an integer `value` sets
that type's override and `null` clears it. Types not named keep their
current value. A value above the organization's own limit is stored, but
the organization limit still applies, so the lower of the two is
enforced.

Returns the targeted group's entry with this request applied, in the shape
`GET /v1/organizations/workspaces/{workspace_id}/rate_limits` returns.
Changes take effect within about an hour.

#### Parameters

- `workspaceID: string` (path parameter)

  The ID of the workspace.

- `rateLimitID: string` (path parameter)

  The `id` of the organization's rate-limit entry to set overrides for.

- `limits: list<WorkspaceRateLimitUpdateValue>`

  Limits to set or clear. Unspecified limit types are unchanged.

#### Returns

- `class WorkspaceRateLimit`

  - `"workspace_rate_limit" type`

    Object type. Always `workspace_rate_limit` for workspace rate-limit entries.

  - `Group group`

    The rate-limit group this entry's limits apply to.

  - `list<WorkspaceRateLimitValue> limits`

    The workspace's limiter values for this group. By default only the limiter types with a workspace-level override are listed. With `include_inherited` set to `true`, the limiter types the workspace inherits from the organization are listed too, each marked by `source`.

  - `?list<string> models`

    Model names this entry's limits apply to, including aliases. `null` when `group.type` is not `"model_group"`. The list covers the models this workspace has access to, so it can differ between workspaces.

  - `string rateLimitID`

    The `id` of the organization's RateLimit entry this entry applies to.

  - `string workspaceID`

    ID of the Workspace this entry applies to.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Workspaces\RateLimits\WorkspaceRateLimitType;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspaceRateLimit = $client->organization->workspaces->rateLimits->update(
  'rate_limit_id',
  workspaceID: 'workspace_id',
  limits: [['type' => WorkspaceRateLimitType::FAST_ITPMCA, 'value' => 0]],
);

var_dump($workspaceRateLimit);
```

##### Response (200)

```json
{
  "group": {
    "id": "id",
    "display_name": "display_name",
    "type": "model_group"
  },
  "limits": [
    {
      "org_limit": 0,
      "source": {
        "type": "workspace"
      },
      "type": "type",
      "value": 0
    }
  ],
  "models": [
    "string"
  ],
  "rate_limit_id": "rate_limit_id",
  "type": "workspace_rate_limit",
  "workspace_id": "workspace_id"
}
```

## Organization › Workspaces › Members

### List Workspace Members

`$client->organization->workspaces->members->list(string workspaceID, ?string afterID, ?string beforeID, ?int limit): Page<WorkspaceMember>`

**GET** `/v1/organizations/workspaces/{workspace_id}/members`

List Workspace Members

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the Workspace.

- `afterID?:optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.

- `beforeID?:optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.

- `limit?:optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

#### Returns

- `class WorkspaceMember`

  - `"workspace_member" type`

    Object type.

    For Workspace Members, this is always `"workspace_member"`.

  - `string userID`

    ID of the User.

  - `string workspaceID`

    ID of the Workspace.

  - `WorkspaceRole workspaceRole`

    Role of the Workspace Member.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->workspaces->members->list(
  'workspace_id', afterID: 'after_id', beforeID: 'before_id', limit: 1
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "type": "workspace_member",
      "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
      "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
      "workspace_role": "workspace_admin"
    }
  ],
  "first_id": "first_id",
  "has_more": true,
  "last_id": "last_id"
}
```

### Create Workspace Member

`$client->organization->workspaces->members->add(string workspaceID, string userID, NoBillingWorkspaceRole workspaceRole): WorkspaceMember`

**POST** `/v1/organizations/workspaces/{workspace_id}/members`

Create Workspace Member

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the Workspace.

- `userID: string`

  ID of the User.

- `workspaceRole: NoBillingWorkspaceRole`

  Role of the new Workspace Member. Cannot be `workspace_billing`.

#### Returns

- `class WorkspaceMember`

  - `"workspace_member" type`

    Object type.

    For Workspace Members, this is always `"workspace_member"`.

  - `string userID`

    ID of the User.

  - `string workspaceID`

    ID of the Workspace.

  - `WorkspaceRole workspaceRole`

    Role of the Workspace Member.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Workspaces\NoBillingWorkspaceRole;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspaceMember = $client->organization->workspaces->members->add(
  'workspace_id',
  userID: 'user_01WCz1FkmYMm4gnmykNKUu3Q',
  workspaceRole: NoBillingWorkspaceRole::WORKSPACE_ADMIN,
);

var_dump($workspaceMember);
```

##### Response (200)

```json
{
  "type": "workspace_member",
  "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
  "workspace_role": "workspace_admin"
}
```

### Get Workspace Member

`$client->organization->workspaces->members->retrieve(string userID, string workspaceID): WorkspaceMember`

**GET** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}`

Get Workspace Member

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the Workspace.

- `userID: string` (path parameter)

  ID of the User.

#### Returns

- `class WorkspaceMember`

  - `"workspace_member" type`

    Object type.

    For Workspace Members, this is always `"workspace_member"`.

  - `string userID`

    ID of the User.

  - `string workspaceID`

    ID of the Workspace.

  - `WorkspaceRole workspaceRole`

    Role of the Workspace Member.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspaceMember = $client->organization->workspaces->members->retrieve(
  'user_id', workspaceID: 'workspace_id'
);

var_dump($workspaceMember);
```

##### Response (200)

```json
{
  "type": "workspace_member",
  "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
  "workspace_role": "workspace_admin"
}
```

### Update Workspace Member

`$client->organization->workspaces->members->update(string userID, string workspaceID, WorkspaceRole workspaceRole): WorkspaceMember`

**POST** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}`

Update Workspace Member

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the Workspace.

- `userID: string` (path parameter)

  ID of the User.

- `workspaceRole: WorkspaceRole`

  New workspace role for the User.

#### Returns

- `class WorkspaceMember`

  - `"workspace_member" type`

    Object type.

    For Workspace Members, this is always `"workspace_member"`.

  - `string userID`

    ID of the User.

  - `string workspaceID`

    ID of the Workspace.

  - `WorkspaceRole workspaceRole`

    Role of the Workspace Member.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Workspaces\WorkspaceRole;

$client = new Client(apiKey: 'my-anthropic-api-key');

$workspaceMember = $client->organization->workspaces->members->update(
  'user_id',
  workspaceID: 'workspace_id',
  workspaceRole: WorkspaceRole::WORKSPACE_ADMIN,
);

var_dump($workspaceMember);
```

##### Response (200)

```json
{
  "type": "workspace_member",
  "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ",
  "workspace_role": "workspace_admin"
}
```

### Delete Workspace Member

`$client->organization->workspaces->members->remove(string userID, string workspaceID): MemberRemoveResponse`

**DELETE** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}`

Delete Workspace Member

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the Workspace.

- `userID: string` (path parameter)

  ID of the User.

#### Returns

- `class MemberRemoveResponse`

  - `"workspace_member_deleted" type`

    Deleted object type.

    For Workspace Members, this is always `"workspace_member_deleted"`.

  - `string userID`

    ID of the User.

  - `string workspaceID`

    ID of the Workspace.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$member = $client->organization->workspaces->members->remove(
  'user_id', workspaceID: 'workspace_id'
);

var_dump($member);
```

##### Response (200)

```json
{
  "type": "workspace_member_deleted",
  "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
  "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
}
```

## Organization › Workspaces › Service Accounts

### List Service Account Workspace Members

`$client->organization->workspaces->serviceAccounts->list(string workspaceID, ?int limit, ?string page): PageCursor<ServiceAccountWorkspaceMember>`

**GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

List the service accounts that are members of a workspace.

Each entry includes the service account's `workspace_role`. Use `limit`
and the `next_page` cursor to paginate. Archived workspaces return 400;
use `GET /service_accounts/{id}/workspaces` to audit memberships of an
archived workspace. The implicit default-workspace membership is not
included in this list. Memberships of archived service accounts are
omitted from the results.

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the workspace.

- `limit?:optional int` (query parameter)

  Number of results per page.

  default: 20

- `page?:optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class ServiceAccountWorkspaceMember`

  - `"service_account_workspace_member" type`

  - `?string createdByActorID`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `?bool implicit`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`).

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole workspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->workspaces->serviceAccounts->list(
  'workspace_id', limit: 1, page: 'page'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "created_by_actor_id": "created_by_actor_id",
      "implicit": true,
      "service_account_id": "service_account_id",
      "type": "service_account_workspace_member",
      "workspace_id": "workspace_id",
      "workspace_role": "workspace_admin"
    }
  ],
  "next_page": "next_page"
}
```

### Create Service Account Workspace Member

`$client->organization->workspaces->serviceAccounts->add(string workspaceID, string serviceAccountID, NoBillingWorkspaceRole workspaceRole): ServiceAccountWorkspaceMember`

**POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Add a service account to a workspace with the given `workspace_role`.

The role determines what the service account can do in the workspace and
which workspace-scoped permissions it can be granted when authenticating
through federation. Every service account is already an implicit
`workspace_user` member of the default workspace; adding it explicitly
assigns a chosen role. If the service account is already an explicit
member of the workspace, its `workspace_role` is replaced with the
value supplied here. Archived workspaces return 400. Archived service
accounts cannot be added and are rejected.

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the workspace.

- `serviceAccountID: string`

  Tagged service account ID to add.

- `workspaceRole: NoBillingWorkspaceRole`

  Role to assign to the service account in this workspace.

#### Returns

- `class ServiceAccountWorkspaceMember`

  - `"service_account_workspace_member" type`

  - `?string createdByActorID`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `?bool implicit`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`).

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole workspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Workspaces\NoBillingWorkspaceRole;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccountWorkspaceMember = $client
  ->organization
  ->workspaces
  ->serviceAccounts
  ->add(
  'workspace_id',
  serviceAccountID: 'service_account_id',
  workspaceRole: NoBillingWorkspaceRole::WORKSPACE_ADMIN,
);

var_dump($serviceAccountWorkspaceMember);
```

##### Response (200)

```json
{
  "created_by_actor_id": "created_by_actor_id",
  "implicit": true,
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member",
  "workspace_id": "workspace_id",
  "workspace_role": "workspace_admin"
}
```

### Get Service Account Workspace Member

`$client->organization->workspaces->serviceAccounts->retrieve(string serviceAccountID, string workspaceID): ServiceAccountWorkspaceMember`

**GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Retrieve a service account's membership in a workspace.

Returns the membership record, including the service account's
`workspace_role` in this workspace. Archived workspaces return 400. For
the default workspace, returns the implicit (`implicit: true`)
membership when no explicit membership exists; an explicitly added
membership is returned with its assigned role. An archived service
account returns 404.

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the workspace.

- `serviceAccountID: string` (path parameter)

  ID of the service account.

#### Returns

- `class ServiceAccountWorkspaceMember`

  - `"service_account_workspace_member" type`

  - `?string createdByActorID`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `?bool implicit`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`).

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole workspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccountWorkspaceMember = $client
  ->organization
  ->workspaces
  ->serviceAccounts
  ->retrieve('service_account_id', workspaceID: 'workspace_id');

var_dump($serviceAccountWorkspaceMember);
```

##### Response (200)

```json
{
  "created_by_actor_id": "created_by_actor_id",
  "implicit": true,
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member",
  "workspace_id": "workspace_id",
  "workspace_role": "workspace_admin"
}
```

### Update Service Account Workspace Member

`$client->organization->workspaces->serviceAccounts->update(string serviceAccountID, string workspaceID, NoBillingWorkspaceRole workspaceRole): ServiceAccountWorkspaceMember`

**POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Change a service account's role in a workspace.

The new `workspace_role` replaces the current one. Only explicit
memberships can be updated; to set a role on the implicit
default-workspace membership, add the service account explicitly with
`POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces
return 400. Archived service accounts cannot be updated and are
rejected.

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the workspace.

- `serviceAccountID: string` (path parameter)

  ID of the service account.

- `workspaceRole: NoBillingWorkspaceRole`

  New role for the service account in this workspace.

#### Returns

- `class ServiceAccountWorkspaceMember`

  - `"service_account_workspace_member" type`

  - `?string createdByActorID`

    Tagged ID (`user_...`/`svac_...`) of the actor who created this membership.

  - `?bool implicit`

    True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed.

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`).

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`).

  - `WorkspaceRole workspaceRole`

    Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;
use Anthropic\Organization\Workspaces\NoBillingWorkspaceRole;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccountWorkspaceMember = $client
  ->organization
  ->workspaces
  ->serviceAccounts
  ->update(
  'service_account_id',
  workspaceID: 'workspace_id',
  workspaceRole: NoBillingWorkspaceRole::WORKSPACE_ADMIN,
);

var_dump($serviceAccountWorkspaceMember);
```

##### Response (200)

```json
{
  "created_by_actor_id": "created_by_actor_id",
  "implicit": true,
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member",
  "workspace_id": "workspace_id",
  "workspace_role": "workspace_admin"
}
```

### Delete Service Account Workspace Member

`$client->organization->workspaces->serviceAccounts->remove(string serviceAccountID, string workspaceID): ServiceAccountRemoveResponse`

**DELETE** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}`

**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=php).

Remove a service account from a workspace.

Removal is idempotent (returns 200 even if the membership was already
removed). A DELETE against the implicit default-workspace membership
returns 200 but is a no-op and the membership persists; deleting an
explicit default-workspace row reverts to the implicit `workspace_user`
membership. Archived workspaces return 400.

#### Parameters

- `workspaceID: string` (path parameter)

  ID of the workspace.

- `serviceAccountID: string` (path parameter)

  ID of the service account.

#### Returns

- `class ServiceAccountRemoveResponse`

  - `"service_account_workspace_member_deleted" type`

  - `string serviceAccountID`

    Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op.

  - `string workspaceID`

    Tagged workspace ID (`wrkspc_...`) named in the delete request.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$serviceAccount = $client->organization->workspaces->serviceAccounts->remove(
  'service_account_id', workspaceID: 'workspace_id'
);

var_dump($serviceAccount);
```

##### Response (200)

```json
{
  "service_account_id": "service_account_id",
  "type": "service_account_workspace_member_deleted",
  "workspace_id": "workspace_id"
}
```

## Organization › Rate Limits

### List Organization Rate Limits

`$client->organization->rateLimits->list(?GroupType groupType, ?int limit, ?string model, ?string page): PageCursor<OrganizationRateLimit>`

**GET** `/v1/organizations/rate_limits`

List Messages API rate limits for your organization.

Each entry corresponds to one rate-limit group (either a model family
or an API-surface category such as the Message Batches API or the web
search tool) and contains the set of limiter values that apply to it.

When `limit` is omitted, every matching entry is returned in a single
page; when `limit` truncates the result, follow `next_page` to fetch
the remaining entries.

#### Parameters

- `groupType?:optional GroupType` (query parameter)

  Filter by group type.

- `limit?:optional int` (query parameter)

  Maximum number of items to return per page. Ranges from `1` to `1000`.

  When omitted, every remaining entry is returned in a single page and `next_page` is `null`.

- `model?:optional string` (query parameter)

  Filter to the single entry containing this model. Accepts full model names and aliases. Returns 404 if the model is not found or has no rate limits for this organization.

- `page?:optional string` (query parameter)

  Opaque cursor from a previous response's `next_page`.

#### Returns

- `class OrganizationRateLimit`

  - `"rate_limit" type`

    Object type. Always `rate_limit` for organization rate-limit entries.

  - `string id`

    Identifier of this rate-limit entry. It is stable within the organization and differs between organizations; the group's own identifier is `group.id`. Pass it as `rate_limit_id` to set a workspace's overrides for this group.

  - `Group group`

    The rate-limit group this entry's limits apply to.

  - `list<OrganizationRateLimitValue> limits`

    The limiter values that apply to this group.

  - `?list<string> models`

    Model names this entry's limits apply to, including aliases. `null` when `group.type` is not `"model_group"`. The list covers the models your organization has access to, so it can differ between organizations.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->rateLimits->list(
  groupType: 'batch', limit: 1, model: 'model', page: 'page'
);

var_dump($page);
```

##### Response (200)

```json
{
  "data": [
    {
      "id": "id",
      "group": {
        "id": "id",
        "display_name": "display_name",
        "type": "model_group"
      },
      "limits": [
        {
          "type": "type",
          "value": 0
        }
      ],
      "models": [
        "string"
      ],
      "type": "rate_limit"
    }
  ],
  "next_page": "next_page"
}
```

## Organization › Compliance Settings

### Get Compliance Settings

`$client->organization->complianceSettings->retrieve(): OrganizationComplianceSettings`

**GET** `/v1/organizations/compliance_settings`

Retrieve your organization's Compliance Settings.

Compliance Settings is a singleton resource: there is exactly one per
organization, addressed without an identifier. The `state` field reflects
whether the Compliance API is enabled. An organization with a parent
organization reads the state inherited from the parent's configuration.

#### Returns

- `class OrganizationComplianceSettings`

  - `"compliance_settings" type`

  - `ComplianceSettingsState state`

    Whether the Compliance API is enabled for this organization.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$organizationComplianceSettings = $client
  ->organization
  ->complianceSettings
  ->retrieve();

var_dump($organizationComplianceSettings);
```

##### Response (200)

```json
{
  "state": {
    "type": "enabled"
  },
  "type": "compliance_settings"
}
```

### Update Compliance Settings

`$client->organization->complianceSettings->update(ComplianceSettingsStateParam state): OrganizationComplianceSettings`

**POST** `/v1/organizations/compliance_settings`

Update your organization's Compliance Settings.

Setting `state` to `enabled` turns on the Compliance API and begins
capturing organization activity events. Setting it to `disabled` turns
both off. `state` reflects whether the Compliance API is enabled.

A request that sets `state` to its current value succeeds and leaves the
resource unchanged. A `disabled` request stays in effect until a later
`enabled` request or the organization's next provisioning action that
enables Access Transparency: enabling Access Transparency also enables
the Compliance API, which serves its activity events, so such
provisioning (including re-runs) re-enables the Compliance API even
after a `disabled` request. Automated provisioning never disables
compliance settings.

#### Parameters

- `state: ComplianceSettingsStateParam`

  Desired state. Accepts the string shorthand "enabled" or "disabled" in place of the object form; the response always returns the canonical object form.

#### Returns

- `class OrganizationComplianceSettings`

  - `"compliance_settings" type`

  - `ComplianceSettingsState state`

    Whether the Compliance API is enabled for this organization.

#### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$organizationComplianceSettings = $client
  ->organization
  ->complianceSettings
  ->update(state: ['type' => 'enabled']);

var_dump($organizationComplianceSettings);
```

##### Response (200)

```json
{
  "state": {
    "type": "enabled"
  },
  "type": "compliance_settings"
}
```