Emisores

Crear emisor de federación

client.organization.federation.issuers.create(body, options?): FederationIssuer

POST/v1/organizations/federation_issuers

Requiere un token de acceso OAuth con el alcance org:admin, obtenido de ant auth login --scope org:admin o de una regla de federación de identidades de carga de trabajo; no se aceptan claves de Admin API. Consulta Administrar WIF con la Admin API.

Listar emisores de federación

client.organization.federation.issuers.list(query?, options?): PageCursor<FederationIssuer>

GET/v1/organizations/federation_issuers

Obtener emisor de federación

client.organization.federation.issuers.retrieve(federationIssuerID, options?): FederationIssuer

GET/v1/organizations/federation_issuers/{federation_issuer_id}

Actualizar emisor de federación

client.organization.federation.issuers.update(federationIssuerID, body, options?): FederationIssuer

POST/v1/organizations/federation_issuers/{federation_issuer_id}

Archivar emisor de federación

client.organization.federation.issuers.archive(federationIssuerID, options?): FederationIssuer

POST/v1/organizations/federation_issuers/{federation_issuer_id}/archive

Models

interface FederationIssuer { type: "federation_issuer"; id; archived_at; /* 12 more */ }

Registered external OIDC identity provider.

Records an external IdP the organization trusts for the RFC 7523 jwt-bearer grant. The issuer_url must match the JWT iss claim exactly.

interface FederationIssuerPollStatus { consecutive_failures; last_fetched_at; next_poll_at }

Status of automatic JWKS polling for a federation issuer.

Anthropic periodically fetches the issuer's signing keys in the background. These fields summarize the most recent fetches so the health of the JWKS endpoint can be monitored.

consecutive_failures: number

Consecutive fetch failures since the last success.

last_fetched_at: string | null

When the last successful fetch completed.

formatdate-time

next_poll_at: string | null

When the next fetch is scheduled. Null if paused.

formatdate-time

interface JWKSDiscovery { type: "discovery"; ca_cert_pem; discovery_base }

JWKS via the issuer's OIDC discovery document.

type: "discovery"

ca_cert_pem?: string | null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength8192

discovery_base?: string | null

Set when the discovery URL differs from issuer_url.

interface JWKSExplicitURL { type: "explicit_url"; url; ca_cert_pem }

JWKS fetched from a fixed endpoint.

type: "explicit_url"

url: string

JWKS endpoint.

minLength1

ca_cert_pem?: string | null

Optional custom CA (PEM) for TLS verification of the JWKS fetch.

maxLength8192

interface JWKSInline { type: "inline"; keys }

JWKS supplied directly; no network fetch.

type: "inline"

keys: Array<Record<string, unknown>>

Inline JWK objects.

minItems1