Claude Platform Docs

Workspaces

List Workspaces
$client->organization->workspaces->list(?string afterID, ?string beforeID, ?bool includeArchived, ?bool includeDefault, ?int limit): Page<Workspace>
GET/v1/organizations/workspaces
Create Workspace
$client->organization->workspaces->create(string name, ?DataResidencyCreateConfig dataResidency, ?string displayColor, ?string externalKeyID, ?array<string,string> tags): Workspace
POST/v1/organizations/workspaces
Get Workspace
$client->organization->workspaces->retrieve(string workspaceID): Workspace
GET/v1/organizations/workspaces/{workspace_id}
Update Workspace
$client->organization->workspaces->update(string workspaceID, ?DataResidencyUpdateConfig dataResidency, ?string displayColor, ?string externalKeyID, ?string name, ?array<string,string> tags): Workspace
POST/v1/organizations/workspaces/{workspace_id}
Archive Workspace
$client->organization->workspaces->archive(string workspaceID): Workspace
POST/v1/organizations/workspaces/{workspace_id}/archive
Models
enum AllowedInferenceGeo
One of the following:
"global"
"us"
class DataResidency { $allowedInferenceGeos; $defaultInferenceGeo; $workspaceGeo; }
AllowedInferenceGeos allowedInferenceGeos

Permitted inference geo values. 'unrestricted' means all geos are allowed.

DefaultInferenceGeo defaultInferenceGeo

Default inference geo applied when requests omit the parameter.

WorkspaceGeo workspaceGeo

Geographic region for workspace data storage. Immutable after creation.

class DataResidencyCreateConfig { $allowedInferenceGeos; $defaultInferenceGeo; $workspaceGeo; }
?AllowedInferenceGeos allowedInferenceGeos

Permitted inference geo values. Defaults to 'unrestricted' if omitted, which allows all geos. Use the string 'unrestricted' to allow all geos, or a list of specific geos.

?DefaultInferenceGeo defaultInferenceGeo

Default inference geo applied when requests omit the parameter. Defaults to 'global' if omitted. Must be a member of allowed_inference_geos unless allowed_inference_geos is "unrestricted".

?WorkspaceGeo workspaceGeo

Geographic region for workspace data storage. Immutable after creation. Defaults to 'us' if omitted.

class DataResidencyUpdateConfig { $allowedInferenceGeos; $defaultInferenceGeo; }
?AllowedInferenceGeos allowedInferenceGeos

Permitted inference geo values. Use 'unrestricted' to allow all geos, or a list of specific geos.

?DefaultInferenceGeo defaultInferenceGeo

Default inference geo applied when requests omit the parameter. Must be a member of allowed_inference_geos unless allowed_inference_geos is "unrestricted".

enum NoBillingWorkspaceRole
One of the following:
"workspace_admin"
"workspace_developer"
"workspace_restricted_developer"
"workspace_user"
class Workspace { $type = 'workspace'; $id; $archivedAt; /* 7 more */ }
"workspace" type

Object type.

For Workspaces, this is always "workspace".

string id

ID of the Workspace.

?\Datetime archivedAt

RFC 3339 datetime string indicating when the Workspace was archived, or null if the Workspace is not archived.

string compartmentID

Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key.

\Datetime createdAt

RFC 3339 datetime string indicating when the Workspace was created.

DataResidency dataResidency

Data residency configuration.

string displayColor

Hex color code representing the Workspace in the Anthropic Console.

?string externalKeyID

ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the external_key_id stays the same.

string name

Name of the Workspace.

array<string,string> tags

User-defined tags as string key-value pairs. Keys may not begin with anthropic.

class WorkspaceMember { $type = 'workspace_member'; $userID; $workspaceID; $workspaceRole; }
"workspace_member" type

Object type.

For Workspace Members, this is always "workspace_member".

string userID

ID of the User.

string workspaceID

ID of the Workspace.

WorkspaceRole workspaceRole

Role of the Workspace Member.

enum WorkspaceRole
One of the following:
"workspace_admin"
"workspace_billing"
"workspace_developer"
"workspace_restricted_developer"
"workspace_user"

WorkspacesRate Limits

List Workspace Rate Limits
$client->organization->workspaces->rateLimits->list(string workspaceID, ?GroupType groupType, ?bool includeInherited, ?int limit, ?string page): PageCursor<WorkspaceRateLimit>
GET/v1/organizations/workspaces/{workspace_id}/rate_limits

List a workspace's rate limits.

Set Workspace Rate Limits
$client->organization->workspaces->rateLimits->update(string rateLimitID, string workspaceID, list<WorkspaceRateLimitUpdateValue> limits): WorkspaceRateLimit
POST/v1/organizations/workspaces/{workspace_id}/rate_limits/{rate_limit_id}

Set or clear rate-limit overrides for one rate-limit group in a workspace.

WorkspacesMembers

List Workspace Members
$client->organization->workspaces->members->list(string workspaceID, ?string afterID, ?string beforeID, ?int limit): Page<WorkspaceMember>
GET/v1/organizations/workspaces/{workspace_id}/members
Create Workspace Member
$client->organization->workspaces->members->add(string workspaceID, string userID, NoBillingWorkspaceRole workspaceRole): WorkspaceMember
POST/v1/organizations/workspaces/{workspace_id}/members
Get Workspace Member
$client->organization->workspaces->members->retrieve(string userID, string workspaceID): WorkspaceMember
GET/v1/organizations/workspaces/{workspace_id}/members/{user_id}
Update Workspace Member
$client->organization->workspaces->members->update(string userID, string workspaceID, WorkspaceRole workspaceRole): WorkspaceMember
POST/v1/organizations/workspaces/{workspace_id}/members/{user_id}
Delete Workspace Member
$client->organization->workspaces->members->remove(string userID, string workspaceID): MemberRemoveResponse
DELETE/v1/organizations/workspaces/{workspace_id}/members/{user_id}

WorkspacesService Accounts

List Service Account Workspace Members
$client->organization->workspaces->serviceAccounts->list(string workspaceID, ?int limit, ?string page): PageCursor<ServiceAccountWorkspaceMember>
GET/v1/organizations/workspaces/{workspace_id}/service_accounts

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Create Service Account Workspace Member
$client->organization->workspaces->serviceAccounts->add(string workspaceID, string serviceAccountID, NoBillingWorkspaceRole workspaceRole): ServiceAccountWorkspaceMember
POST/v1/organizations/workspaces/{workspace_id}/service_accounts

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Get Service Account Workspace Member
$client->organization->workspaces->serviceAccounts->retrieve(string serviceAccountID, string workspaceID): ServiceAccountWorkspaceMember
GET/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Update Service Account Workspace Member
$client->organization->workspaces->serviceAccounts->update(string serviceAccountID, string workspaceID, NoBillingWorkspaceRole workspaceRole): ServiceAccountWorkspaceMember
POST/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.

Delete Service Account Workspace Member
$client->organization->workspaces->serviceAccounts->remove(string serviceAccountID, string workspaceID): ServiceAccountRemoveResponse
DELETE/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}

Requires an OAuth access token with the org:admin scope, from ant auth login --scope org:admin or a workload identity federation rule; Admin API keys are not accepted. See Manage WIF with the Admin API.