Claude Platform Docs

Actualizar regla de federación

$client->organization->federation->rules->update(string federationRuleID, ?bool appliesToAllWorkspaces, ?string description, ?FederationRuleMatch match, ?string name, ?string oauthScope, ?ServiceAccountTarget target, ?int tokenLifetimeSeconds, ?string workspaceID): FederationRule
POST/v1/organizations/federation_rules/{federation_rule_id}

Requiere un token de acceso OAuth con el alcance org:admin, obtenido de ant auth login --scope org:admin o de una regla de federación de identidades de carga de trabajo; no se aceptan claves de Admin API. Consulta Administrar WIF con la Admin API.

Actualiza parcialmente una regla de federación.

issuer_id es inmutable. match y target se reemplazan como objetos completos cuando se establecen. Las cuentas de servicio y los espacios de trabajo referenciados deben existir en tu organización; las referencias no válidas se rechazan con un error 400. Las reglas archivadas no se pueden actualizar; esto devuelve 400. En su lugar, crea una nueva regla. Las reglas sobre emisores compartidos conocidos (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) deben restringir la identidad del tenant mediante un claim que contenga identidad, un prefijo de subject que fije el tenant (como repo:YOUR_ORG/...) o una condición CEL que haga referencia a uno de esos claims de identidad (p. ej., claims.repository_owner). En estos emisores, el requisito se vuelve a comprobar en cada actualización; si la coincidencia almacenada de una regla existente todavía no restringe la identidad del tenant, cualquier actualización (incluso un cambio de nombre o de descripción) también debe proporcionar un match conforme en la misma solicitud. Los llamadores OAuth solo pueden administrar reglas cuyo oauth_scope sea workspace:developer o workspace:inference; otros alcances requieren una sesión de Console.

Parameters
federationRuleID: string⁠Path parameter

ID of the federation rule to update.

appliesToAllWorkspaces?: optional bool

When true, enables this rule for every workspace in the org (including workspaces created later). Setting false is rejected with 400 if no workspace would remain enabled; a rule with only a legacy workspace_id binding continues to mint.

description?: optional string

Replaces the description. Omit to leave unchanged; send null to clear (the field is stored as an empty string).

match?: optional FederationRuleMatch

Replaces the entire match object. All populated matcher fields must pass.

name?: optional string

Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

oauthScope?: optional string

Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

target?: optional ServiceAccountTarget

Replaces the entire target object. Currently always a service_account target.

tokenLifetimeSeconds?: optional int

Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

workspaceID?: optional string

Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the /federation_rules/{federation_rule_id}/workspaces sub-resource instead.

Returns
class FederationRule { $type = 'federation_rule'; $id; $appliesToAllWorkspaces; /* 15 more */ }
Actualizar regla de federación
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$federationRule = $client->organization->federation->rules->update(
  'federation_rule_id',
  appliesToAllWorkspaces: true,
  description: 'description',
  match: [
    'audience' => 'audience',
    'claims' => ['foo' => 'string'],
    'condition' => 'condition',
    'subjectPrefix' => 'subject_prefix',
  ],
  name: 'x',
  oauthScope: 'x',
  target: [
    'serviceAccountID' => 'svac_01SDCCSbTxrXDpWc1phhtcfK',
    'type' => 'service_account',
    'serviceAccountName' => 'service_account_name',
  ],
  tokenLifetimeSeconds: 60,
  workspaceID: 'workspace_id',
);

var_dump($federationRule);
Returns Examples
Response 200
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}