Claude Platform Docs

Créer une règle de fédération

FederationRule organization().federation().rules().create(params, requestOptions = RequestOptions.none())
POST/v1/organizations/federation_rules

Nécessite un jeton d'accès OAuth avec la portée org:admin, obtenu via ant auth login --scope org:admin ou une règle de workload identity federation (fédération d'identité de charge de travail) ; les clés Admin API ne sont pas acceptées. Consultez Gérer WIF avec l'Admin API.

Créez une règle de fédération appartenant à votre organisation.

L'émetteur référencé et le compte de service cible doivent déjà exister dans la même organisation ; les références invalides sont rejetées avec une erreur 400. La référence à l'espace de travail est validée. L'appartenance n'est pas vérifiée lors de la création de la règle : l'échange de jetons résout un seul espace de travail activé par appel et est rejeté sauf si le compte de service cible est membre de cet espace de travail (il est implicitement membre de l'espace de travail par défaut). Les règles portant sur des émetteurs partagés bien connus (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) doivent contraindre l'identité du locataire via une revendication porteuse d'identité, un préfixe de sujet épinglant le locataire (tel que repo:YOUR_ORG/...), ou une condition CEL référençant l'une de ces revendications d'identité (par ex. claims.repository_owner). Les appelants OAuth ne peuvent gérer que les règles dont l'oauth_scope est workspace:developer ou workspace:inference ; les autres portées nécessitent une session Console.

Parameters
RuleCreateParams params
String issuerId

Tagged ID of the federation issuer.

FederationRuleMatch match

Conditions the verified JWT must satisfy for this rule to apply. At least one of subject_prefix (other than a wildcard-only value like *), claims, or condition is required; audience alone is not sufficient.

String name

Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength1
maxLength255
String oauthScope

Space-separated OAuth scopes. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

minLength1
ServiceAccountTarget target

Identity that tokens minted via this rule act as. Currently always a service_account target.

Optional<Boolean> appliesToAllWorkspaces

When true, enable this rule for every workspace in the org (including workspaces created later).

Optional<String> description

Optional free-text description.

maxLength2000
Optional<Long> tokenLifetimeSeconds

Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

minimum60
maximum86400
Optional<String> workspaceId

Tagged ID of the workspace to enable this rule for. Required unless applies_to_all_workspaces is true. Additional workspaces can be added via the /federation_rules/{federation_rule_id}/workspaces sub-resource.

Returns
class FederationRule { type = "federation_rule"; id; appliesToAllWorkspaces; /* 15 more */ }

Authorization rule binding an external OIDC identity to Anthropic.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

Créer une règle de fédération
package com.anthropic.example;

import com.anthropic.client.AnthropicClient;
import com.anthropic.client.okhttp.AnthropicOkHttpClient;
import com.anthropic.models.organization.federation.rules.FederationRule;
import com.anthropic.models.organization.federation.rules.FederationRuleMatch;
import com.anthropic.models.organization.federation.rules.RuleCreateParams;
import com.anthropic.models.organization.federation.rules.ServiceAccountTarget;

public final class Main {
    private Main() {}

    public static void main(String[] args) {
        AnthropicClient client = AnthropicOkHttpClient.fromEnv();

        RuleCreateParams params = RuleCreateParams.builder()
            .issuerId("issuer_id")
            .match(FederationRuleMatch.builder().build())
            .name("x")
            .oauthScope("x")
            .target(ServiceAccountTarget.of("svac_01SDCCSbTxrXDpWc1phhtcfK"))
            .build();
        FederationRule federationRule = client.organization().federation().rules().create(params);
    }
}
Returns Examples
Response 200
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}