--- title: Workspaces url: https://platform.claude.com/docs/en/api/go/organization/workspaces --- # Workspaces ## List Workspaces `client.Organization.Workspaces.List(ctx, query) (*Page[Workspace], error)` **GET** `/v1/organizations/workspaces` List Workspaces ### Parameters - `query OrganizationWorkspaceListParams` - `AfterID param.Opt[string] Optional` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `BeforeID param.Opt[string] Optional` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `IncludeArchived param.Opt[bool] Optional` (query parameter) Whether to include Workspaces that have been archived in the response - `IncludeDefault param.Opt[bool] Optional` (query parameter) Whether to include the organization's default Workspace in the response - `Limit param.Opt[int64] Optional` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 ### Returns - `type Workspace` - `Type Workspace` Object type. For Workspaces, this is always `"workspace"`. default: workspace - `ID string` ID of the Workspace. - `ArchivedAt Time` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `CompartmentID string` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `CreatedAt Time` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `DataResidency DataResidency` Data residency configuration. - `AllowedInferenceGeos DataResidencyAllowedInferenceGeosUnion` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `[]AllowedInferenceGeo` - `const AllowedInferenceGeoGlobal AllowedInferenceGeo = "global"` - `const AllowedInferenceGeoUs AllowedInferenceGeo = "us"` - `Unrestricted` - `DefaultInferenceGeo DataResidencyDefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `const DataResidencyDefaultInferenceGeoGlobal DataResidencyDefaultInferenceGeo = "global"` - `const DataResidencyDefaultInferenceGeoUs DataResidencyDefaultInferenceGeo = "us"` - `WorkspaceGeo DataResidencyWorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `DisplayColor string` Hex color code representing the Workspace in the Anthropic Console. - `ExternalKeyID string` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `Name string` Name of the Workspace. - `Tags map[string, string]` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) page, err := client.Organization.Workspaces.List(context.TODO(), anthropic.OrganizationWorkspaceListParams{}) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response (200) ```json { "data": [ { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ## Create Workspace `client.Organization.Workspaces.New(ctx, body) (*Workspace, error)` **POST** `/v1/organizations/workspaces` Create Workspace ### Parameters - `body OrganizationWorkspaceNewParams` - `Name string` Name of the Workspace. minLength: 1, maxLength: 255 - `DataResidency DataResidencyCreateConfigParam Optional` Data residency configuration for the workspace. If omitted, defaults to `workspace_geo: "us"`, `allowed_inference_geos: "unrestricted"`, and `default_inference_geo: "global"`. - `DisplayColor param.Opt[string] Optional` Hex color code representing the Workspace in the Anthropic Console. maxLength: 7, pattern: ^#[0-9A-Fa-f]{6}$ - `ExternalKeyID param.Opt[string] Optional` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `Tags map[string, string] Optional` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Returns - `type Workspace` - `Type Workspace` Object type. For Workspaces, this is always `"workspace"`. default: workspace - `ID string` ID of the Workspace. - `ArchivedAt Time` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `CompartmentID string` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `CreatedAt Time` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `DataResidency DataResidency` Data residency configuration. - `AllowedInferenceGeos DataResidencyAllowedInferenceGeosUnion` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `[]AllowedInferenceGeo` - `const AllowedInferenceGeoGlobal AllowedInferenceGeo = "global"` - `const AllowedInferenceGeoUs AllowedInferenceGeo = "us"` - `Unrestricted` - `DefaultInferenceGeo DataResidencyDefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `const DataResidencyDefaultInferenceGeoGlobal DataResidencyDefaultInferenceGeo = "global"` - `const DataResidencyDefaultInferenceGeoUs DataResidencyDefaultInferenceGeo = "us"` - `WorkspaceGeo DataResidencyWorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `DisplayColor string` Hex color code representing the Workspace in the Anthropic Console. - `ExternalKeyID string` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `Name string` Name of the Workspace. - `Tags map[string, string]` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) workspace, err := client.Organization.Workspaces.New(context.TODO(), anthropic.OrganizationWorkspaceNewParams{ Name: "x", }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", workspace.ID) } ``` #### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ``` ## Get Workspace `client.Organization.Workspaces.Get(ctx, workspaceID) (*Workspace, error)` **GET** `/v1/organizations/workspaces/{workspace_id}` Get Workspace ### Parameters - `workspaceID string` (path parameter) ID of the Workspace. ### Returns - `type Workspace` - `Type Workspace` Object type. For Workspaces, this is always `"workspace"`. default: workspace - `ID string` ID of the Workspace. - `ArchivedAt Time` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `CompartmentID string` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `CreatedAt Time` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `DataResidency DataResidency` Data residency configuration. - `AllowedInferenceGeos DataResidencyAllowedInferenceGeosUnion` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `[]AllowedInferenceGeo` - `const AllowedInferenceGeoGlobal AllowedInferenceGeo = "global"` - `const AllowedInferenceGeoUs AllowedInferenceGeo = "us"` - `Unrestricted` - `DefaultInferenceGeo DataResidencyDefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `const DataResidencyDefaultInferenceGeoGlobal DataResidencyDefaultInferenceGeo = "global"` - `const DataResidencyDefaultInferenceGeoUs DataResidencyDefaultInferenceGeo = "us"` - `WorkspaceGeo DataResidencyWorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `DisplayColor string` Hex color code representing the Workspace in the Anthropic Console. - `ExternalKeyID string` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `Name string` Name of the Workspace. - `Tags map[string, string]` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) workspace, err := client.Organization.Workspaces.Get(context.TODO(), "workspace_id") if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", workspace.ID) } ``` #### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ``` ## Update Workspace `client.Organization.Workspaces.Update(ctx, workspaceID, body) (*Workspace, error)` **POST** `/v1/organizations/workspaces/{workspace_id}` Update Workspace ### Parameters - `workspaceID string` (path parameter) - `body OrganizationWorkspaceUpdateParams` - `DataResidency DataResidencyUpdateConfigParam Optional` Data residency configuration for the workspace. - `DisplayColor param.Opt[string] Optional` Hex color code representing the Workspace in the Anthropic Console. maxLength: 7, pattern: ^#[0-9A-Fa-f]{6}$ - `ExternalKeyID param.Opt[string] Optional` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `Name param.Opt[string] Optional` Name of the Workspace. minLength: 1, maxLength: 255 - `Tags map[string, string] Optional` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Returns - `type Workspace` - `Type Workspace` Object type. For Workspaces, this is always `"workspace"`. default: workspace - `ID string` ID of the Workspace. - `ArchivedAt Time` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `CompartmentID string` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `CreatedAt Time` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `DataResidency DataResidency` Data residency configuration. - `AllowedInferenceGeos DataResidencyAllowedInferenceGeosUnion` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `[]AllowedInferenceGeo` - `const AllowedInferenceGeoGlobal AllowedInferenceGeo = "global"` - `const AllowedInferenceGeoUs AllowedInferenceGeo = "us"` - `Unrestricted` - `DefaultInferenceGeo DataResidencyDefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `const DataResidencyDefaultInferenceGeoGlobal DataResidencyDefaultInferenceGeo = "global"` - `const DataResidencyDefaultInferenceGeoUs DataResidencyDefaultInferenceGeo = "us"` - `WorkspaceGeo DataResidencyWorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `DisplayColor string` Hex color code representing the Workspace in the Anthropic Console. - `ExternalKeyID string` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `Name string` Name of the Workspace. - `Tags map[string, string]` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) workspace, err := client.Organization.Workspaces.Update( context.TODO(), "workspace_id", anthropic.OrganizationWorkspaceUpdateParams{}, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", workspace.ID) } ``` #### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ``` ## Archive Workspace `client.Organization.Workspaces.Archive(ctx, workspaceID) (*Workspace, error)` **POST** `/v1/organizations/workspaces/{workspace_id}/archive` Archive Workspace ### Parameters - `workspaceID string` (path parameter) ### Returns - `type Workspace` - `Type Workspace` Object type. For Workspaces, this is always `"workspace"`. default: workspace - `ID string` ID of the Workspace. - `ArchivedAt Time` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `CompartmentID string` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `CreatedAt Time` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `DataResidency DataResidency` Data residency configuration. - `AllowedInferenceGeos DataResidencyAllowedInferenceGeosUnion` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `[]AllowedInferenceGeo` - `const AllowedInferenceGeoGlobal AllowedInferenceGeo = "global"` - `const AllowedInferenceGeoUs AllowedInferenceGeo = "us"` - `Unrestricted` - `DefaultInferenceGeo DataResidencyDefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `const DataResidencyDefaultInferenceGeoGlobal DataResidencyDefaultInferenceGeo = "global"` - `const DataResidencyDefaultInferenceGeoUs DataResidencyDefaultInferenceGeo = "us"` - `WorkspaceGeo DataResidencyWorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `DisplayColor string` Hex color code representing the Workspace in the Anthropic Console. - `ExternalKeyID string` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `Name string` Name of the Workspace. - `Tags map[string, string]` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) workspace, err := client.Organization.Workspaces.Archive(context.TODO(), "workspace_id") if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", workspace.ID) } ``` #### Response (200) ```json { "id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "archived_at": "2024-11-01T23:59:27.427722Z", "compartment_id": "f8a7b6c5-4d3e-4f1a-8b9c-0d1e2f3a4b5c", "created_at": "2024-10-30T23:58:27.427722Z", "data_residency": { "allowed_inference_geos": "unrestricted", "default_inference_geo": "global", "workspace_geo": "us" }, "display_color": "#6C5BB9", "external_key_id": "ekey_01SDCCSbTxrXDpWc1phhtcfK", "name": "Workspace Name", "tags": { "env": "prod", "team": "platform" }, "type": "workspace" } ``` ## Domain types ### Allowed Inference Geo - `type AllowedInferenceGeo string` - `const AllowedInferenceGeoGlobal AllowedInferenceGeo = "global"` - `const AllowedInferenceGeoUs AllowedInferenceGeo = "us"` ### Data Residency - `type DataResidency` - `AllowedInferenceGeos DataResidencyAllowedInferenceGeosUnion` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `[]AllowedInferenceGeo` - `const AllowedInferenceGeoGlobal AllowedInferenceGeo = "global"` - `const AllowedInferenceGeoUs AllowedInferenceGeo = "us"` - `Unrestricted` - `DefaultInferenceGeo DataResidencyDefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `const DataResidencyDefaultInferenceGeoGlobal DataResidencyDefaultInferenceGeo = "global"` - `const DataResidencyDefaultInferenceGeoUs DataResidencyDefaultInferenceGeo = "us"` - `WorkspaceGeo DataResidencyWorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. ### Data Residency Create Config - `type DataResidencyCreateConfigParam` - `AllowedInferenceGeos DataResidencyCreateConfigAllowedInferenceGeosUnionParam Optional` Permitted inference geo values. Defaults to 'unrestricted' if omitted, which allows all geos. Use the string 'unrestricted' to allow all geos, or a list of specific geos. - `[]AllowedInferenceGeo` - `const AllowedInferenceGeoGlobal AllowedInferenceGeo = "global"` - `const AllowedInferenceGeoUs AllowedInferenceGeo = "us"` - `Unrestricted` - `DefaultInferenceGeo DataResidencyCreateConfigDefaultInferenceGeo Optional` Default inference geo applied when requests omit the parameter. Defaults to 'global' if omitted. Must be a member of `allowed_inference_geos` unless `allowed_inference_geos` is `"unrestricted"`. - `const DataResidencyCreateConfigDefaultInferenceGeoGlobal DataResidencyCreateConfigDefaultInferenceGeo = "global"` - `const DataResidencyCreateConfigDefaultInferenceGeoUs DataResidencyCreateConfigDefaultInferenceGeo = "us"` - `WorkspaceGeo DataResidencyCreateConfigWorkspaceGeo Optional` Geographic region for workspace data storage. Immutable after creation. Defaults to 'us' if omitted. ### Data Residency Update Config - `type DataResidencyUpdateConfigParam` - `AllowedInferenceGeos DataResidencyUpdateConfigAllowedInferenceGeosUnionParam Optional` Permitted inference geo values. Use 'unrestricted' to allow all geos, or a list of specific geos. - `[]AllowedInferenceGeo` - `const AllowedInferenceGeoGlobal AllowedInferenceGeo = "global"` - `const AllowedInferenceGeoUs AllowedInferenceGeo = "us"` - `Unrestricted` - `DefaultInferenceGeo DataResidencyUpdateConfigDefaultInferenceGeo Optional` Default inference geo applied when requests omit the parameter. Must be a member of `allowed_inference_geos` unless `allowed_inference_geos` is `"unrestricted"`. - `const DataResidencyUpdateConfigDefaultInferenceGeoGlobal DataResidencyUpdateConfigDefaultInferenceGeo = "global"` - `const DataResidencyUpdateConfigDefaultInferenceGeoUs DataResidencyUpdateConfigDefaultInferenceGeo = "us"` ### No Billing Workspace Role - `type NoBillingWorkspaceRole string` - `const NoBillingWorkspaceRoleWorkspaceAdmin NoBillingWorkspaceRole = "workspace_admin"` - `const NoBillingWorkspaceRoleWorkspaceDeveloper NoBillingWorkspaceRole = "workspace_developer"` - `const NoBillingWorkspaceRoleWorkspaceRestrictedDeveloper NoBillingWorkspaceRole = "workspace_restricted_developer"` - `const NoBillingWorkspaceRoleWorkspaceUser NoBillingWorkspaceRole = "workspace_user"` ### Workspace - `type Workspace` - `Type Workspace` Object type. For Workspaces, this is always `"workspace"`. default: workspace - `ID string` ID of the Workspace. - `ArchivedAt Time` RFC 3339 datetime string indicating when the Workspace was archived, or `null` if the Workspace is not archived. format: date-time - `CompartmentID string` Identifier for this Workspace's encryption compartment. When you configure a customer-managed encryption key (CMEK) on AWS, reference this value in your KMS key-policy condition so the key is scoped to this compartment. On GCP and Azure, Anthropic enforces the compartment binding automatically; you do not need to reference this value in your key configuration. See the CMEK integration guide for the required key configuration; unless your organization is on Claude Platform on AWS, it includes a separate value used during key validation. On Claude Platform on AWS there is no separate validation value: the key is validated against this Workspace's own value when it is attached, so if your key policy uses the compartment condition, add this value to it before attaching the key. - `CreatedAt Time` RFC 3339 datetime string indicating when the Workspace was created. format: date-time - `DataResidency DataResidency` Data residency configuration. - `AllowedInferenceGeos DataResidencyAllowedInferenceGeosUnion` Permitted inference geo values. 'unrestricted' means all geos are allowed. - `[]AllowedInferenceGeo` - `const AllowedInferenceGeoGlobal AllowedInferenceGeo = "global"` - `const AllowedInferenceGeoUs AllowedInferenceGeo = "us"` - `Unrestricted` - `DefaultInferenceGeo DataResidencyDefaultInferenceGeo` Default inference geo applied when requests omit the parameter. - `const DataResidencyDefaultInferenceGeoGlobal DataResidencyDefaultInferenceGeo = "global"` - `const DataResidencyDefaultInferenceGeoUs DataResidencyDefaultInferenceGeo = "us"` - `WorkspaceGeo DataResidencyWorkspaceGeo` Geographic region for workspace data storage. Immutable after creation. - `DisplayColor string` Hex color code representing the Workspace in the Anthropic Console. - `ExternalKeyID string` ID of the customer-managed encryption key (CMEK) configuration to use for this Workspace. Setting this field requires CMEK to be enabled for your organization. When set, data stored for this Workspace is encrypted with the referenced key. Create key configurations with the External Keys API. On Claude Platform on AWS the value is the AWS KMS key ARN, and the key must be a single-Region key in the same AWS account and Region as the Workspace. On that platform the key is validated against this Workspace when it is attached, so a key-policy problem is reported as an error on this request. This field is write-once: once a key is attached to a Workspace it cannot be detached or replaced. To rotate key material, rotate the underlying key on your cloud KMS; the `external_key_id` stays the same. - `Name string` Name of the Workspace. - `Tags map[string, string]` User-defined tags as string key-value pairs. Keys may not begin with `anthropic`. ### Workspace Member - `type WorkspaceMember` - `Type WorkspaceMember` Object type. For Workspace Members, this is always `"workspace_member"`. default: workspace_member - `UserID string` ID of the User. - `WorkspaceID string` ID of the Workspace. - `WorkspaceRole WorkspaceRole` Role of the Workspace Member. - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"` - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"` - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"` - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"` - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"` ### Workspace Role - `type WorkspaceRole string` - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"` - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"` - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"` - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"` - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"` ## Workspaces › Rate Limits ### List Workspace Rate Limits `client.Organization.Workspaces.RateLimits.List(ctx, workspaceID, query) (*PageCursor[WorkspaceRateLimit], error)` **GET** `/v1/organizations/workspaces/{workspace_id}/rate_limits` List a workspace's rate limits. By default, returns only the groups and limiter types that have a workspace-level override. With `include_inherited=true`, returns every group with organization-level limits the workspace can see, listing for each the values it inherits from the organization as well as its own overrides. Each value's `source` says which it is. When `limit` is omitted, every matching entry is returned in a single page; when `limit` truncates the result, follow `next_page` to fetch the remaining entries. #### Parameters - `workspaceID string` (path parameter) The ID of the workspace. - `query OrganizationWorkspaceRateLimitListParams` - `GroupType OrganizationWorkspaceRateLimitListParamsGroupType Optional` (query parameter) Filter by group type. - `const OrganizationWorkspaceRateLimitListParamsGroupTypeBatch OrganizationWorkspaceRateLimitListParamsGroupType = "batch"` - `const OrganizationWorkspaceRateLimitListParamsGroupTypeFiles OrganizationWorkspaceRateLimitListParamsGroupType = "files"` - `const OrganizationWorkspaceRateLimitListParamsGroupTypeModelGroup OrganizationWorkspaceRateLimitListParamsGroupType = "model_group"` - `const OrganizationWorkspaceRateLimitListParamsGroupTypeSkills OrganizationWorkspaceRateLimitListParamsGroupType = "skills"` - `const OrganizationWorkspaceRateLimitListParamsGroupTypeTokenCount OrganizationWorkspaceRateLimitListParamsGroupType = "token_count"` - `const OrganizationWorkspaceRateLimitListParamsGroupTypeWebSearch OrganizationWorkspaceRateLimitListParamsGroupType = "web_search"` - `IncludeInherited param.Opt[bool] Optional` (query parameter) Also list the limiter values the workspace inherits from the organization, including groups with no workspace-level override. - `Limit param.Opt[int64] Optional` (query parameter) Maximum number of items to return per page. Ranges from `1` to `1000`. When omitted, every remaining entry is returned in a single page and `next_page` is `null`. minimum: 1, maximum: 1000 - `Page param.Opt[string] Optional` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `type WorkspaceRateLimit` - `Type WorkspaceRateLimit` Object type. Always `workspace_rate_limit` for workspace rate-limit entries. default: workspace_rate_limit - `Group WorkspaceRateLimitGroupUnion` The rate-limit group this entry's limits apply to. Its `type` equals `group_type`. - `type OrganizationRateLimitModelGroup` - `Type ModelGroup` Always `model_group`: a family of models. default: model_group - `ID string` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `DisplayName string` Human-readable name of the model group (for example, `Claude Sonnet 4.x`). For display only; it may change. - `type OrganizationRateLimitBatchGroup` - `Type Batch` Always `batch`: the Message Batches API. default: batch - `ID string` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `type OrganizationRateLimitTokenCountGroup` - `Type TokenCount` Always `token_count`: the Token Count API. default: token_count - `ID string` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `type OrganizationRateLimitFilesGroup` - `Type Files` Always `files`: the Files API. default: files - `ID string` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `type OrganizationRateLimitSkillsGroup` - `Type Skills` Always `skills`: the Skills API. default: skills - `ID string` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `type OrganizationRateLimitWebSearchGroup` - `Type WebSearch` Always `web_search`: the Messages API web search tool. default: web_search - `ID string` Opaque identifier of the rate-limit group (for example, `rlg_01VPTCmyiu5ZLsWkcxYG2pY8`). It is the same in every organization and never changes, unlike the entry's own identifier, which differs per organization. - `Limits []WorkspaceRateLimitValue` The workspace's limiter values for this group. By default only the limiter types with a workspace-level override are listed. With `include_inherited` set to `true`, the limiter types the workspace inherits from the organization are listed too, each marked by `source`. - `Type string` The limiter type (for example, `requests_per_minute` or `input_tokens_per_minute`). - `OrgLimit int64` The organization-level value for the same limiter type, for reference. `null` when the organization has no limit configured for this limiter type. - `Source WorkspaceRateLimitValueSourceUnion` Where `value` comes from. `organization` values are listed only when `include_inherited` is `true`, and then `value` equals `org_limit`. - `type WorkspaceRateLimitWorkspaceSource` - `Type Workspace` Always `workspace`: a workspace-level override is stored. default: workspace - `type WorkspaceRateLimitOrganizationSource` - `Type Organization` Always `organization`: no workspace-level override is stored, so the organization's value applies. default: organization - `Value int64` The workspace's value for this limiter type: the workspace-level override when `source.type` is `workspace`, otherwise the organization's value. - `Models []string` Model names this entry's limits apply to, including aliases. `null` when `group_type` is not `"model_group"`. - `RateLimitID string` The `id` of the organization's RateLimit entry this entry applies to. - `WorkspaceID string` ID of the Workspace this entry applies to. #### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) page, err := client.Organization.Workspaces.RateLimits.List( context.TODO(), "workspace_id", anthropic.OrganizationWorkspaceRateLimitListParams{}, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` ##### Response (200) ```json { "data": [ { "group": { "id": "id", "display_name": "display_name", "type": "model_group" }, "group_type": "batch", "limits": [ { "org_limit": 0, "source": { "type": "workspace" }, "type": "type", "value": 0 } ], "models": [ "string" ], "rate_limit_id": "rate_limit_id", "type": "workspace_rate_limit", "workspace_id": "workspace_id" } ], "next_page": "next_page" } ``` ## Workspaces › Members ### List Workspace Members `client.Organization.Workspaces.Members.List(ctx, workspaceID, query) (*Page[WorkspaceMember], error)` **GET** `/v1/organizations/workspaces/{workspace_id}/members` List Workspace Members #### Parameters - `workspaceID string` (path parameter) ID of the Workspace. - `query OrganizationWorkspaceMemberListParams` - `AfterID param.Opt[string] Optional` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `BeforeID param.Opt[string] Optional` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `Limit param.Opt[int64] Optional` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 #### Returns - `type WorkspaceMember` - `Type WorkspaceMember` Object type. For Workspace Members, this is always `"workspace_member"`. default: workspace_member - `UserID string` ID of the User. - `WorkspaceID string` ID of the Workspace. - `WorkspaceRole WorkspaceRole` Role of the Workspace Member. - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"` - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"` - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"` - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"` - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"` #### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) page, err := client.Organization.Workspaces.Members.List( context.TODO(), "workspace_id", anthropic.OrganizationWorkspaceMemberListParams{}, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` ##### Response (200) ```json { "data": [ { "type": "workspace_member", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ### Create Workspace Member `client.Organization.Workspaces.Members.Add(ctx, workspaceID, body) (*WorkspaceMember, error)` **POST** `/v1/organizations/workspaces/{workspace_id}/members` Create Workspace Member #### Parameters - `workspaceID string` (path parameter) ID of the Workspace. - `body OrganizationWorkspaceMemberAddParams` - `UserID string` ID of the User. - `WorkspaceRole NoBillingWorkspaceRole` Role of the new Workspace Member. Cannot be `workspace_billing`. #### Returns - `type WorkspaceMember` - `Type WorkspaceMember` Object type. For Workspace Members, this is always `"workspace_member"`. default: workspace_member - `UserID string` ID of the User. - `WorkspaceID string` ID of the Workspace. - `WorkspaceRole WorkspaceRole` Role of the Workspace Member. - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"` - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"` - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"` - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"` - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"` #### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) workspaceMember, err := client.Organization.Workspaces.Members.Add( context.TODO(), "workspace_id", anthropic.OrganizationWorkspaceMemberAddParams{ UserID: "user_01WCz1FkmYMm4gnmykNKUu3Q", WorkspaceRole: anthropic.NoBillingWorkspaceRoleWorkspaceAdmin, }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", workspaceMember.UserID) } ``` ##### Response (200) ```json { "type": "workspace_member", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ``` ### Get Workspace Member `client.Organization.Workspaces.Members.Get(ctx, userID, query) (*WorkspaceMember, error)` **GET** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}` Get Workspace Member #### Parameters - `userID string` (path parameter) ID of the User. - `query OrganizationWorkspaceMemberGetParams` - `WorkspaceID string` (path parameter) ID of the Workspace. #### Returns - `type WorkspaceMember` - `Type WorkspaceMember` Object type. For Workspace Members, this is always `"workspace_member"`. default: workspace_member - `UserID string` ID of the User. - `WorkspaceID string` ID of the Workspace. - `WorkspaceRole WorkspaceRole` Role of the Workspace Member. - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"` - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"` - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"` - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"` - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"` #### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) workspaceMember, err := client.Organization.Workspaces.Members.Get( context.TODO(), "user_id", anthropic.OrganizationWorkspaceMemberGetParams{ WorkspaceID: "workspace_id", }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", workspaceMember.UserID) } ``` ##### Response (200) ```json { "type": "workspace_member", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ``` ### Update Workspace Member `client.Organization.Workspaces.Members.Update(ctx, userID, params) (*WorkspaceMember, error)` **POST** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}` Update Workspace Member #### Parameters - `userID string` (path parameter) ID of the User. - `params OrganizationWorkspaceMemberUpdateParams` - `WorkspaceID string` (path parameter) ID of the Workspace. - `WorkspaceRole WorkspaceRole` New workspace role for the User. #### Returns - `type WorkspaceMember` - `Type WorkspaceMember` Object type. For Workspace Members, this is always `"workspace_member"`. default: workspace_member - `UserID string` ID of the User. - `WorkspaceID string` ID of the Workspace. - `WorkspaceRole WorkspaceRole` Role of the Workspace Member. - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"` - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"` - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"` - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"` - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"` #### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) workspaceMember, err := client.Organization.Workspaces.Members.Update( context.TODO(), "user_id", anthropic.OrganizationWorkspaceMemberUpdateParams{ WorkspaceID: "workspace_id", WorkspaceRole: anthropic.WorkspaceRoleWorkspaceAdmin, }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", workspaceMember.UserID) } ``` ##### Response (200) ```json { "type": "workspace_member", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ", "workspace_role": "workspace_admin" } ``` ### Delete Workspace Member `client.Organization.Workspaces.Members.Remove(ctx, userID, body) (*OrganizationWorkspaceMemberRemoveResponse, error)` **DELETE** `/v1/organizations/workspaces/{workspace_id}/members/{user_id}` Delete Workspace Member #### Parameters - `userID string` (path parameter) ID of the User. - `body OrganizationWorkspaceMemberRemoveParams` - `WorkspaceID string` (path parameter) ID of the Workspace. #### Returns - `type OrganizationWorkspaceMemberRemoveResponse` - `Type WorkspaceMemberDeleted` Deleted object type. For Workspace Members, this is always `"workspace_member_deleted"`. default: workspace_member_deleted - `UserID string` ID of the User. - `WorkspaceID string` ID of the Workspace. #### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) member, err := client.Organization.Workspaces.Members.Remove( context.TODO(), "user_id", anthropic.OrganizationWorkspaceMemberRemoveParams{ WorkspaceID: "workspace_id", }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", member.UserID) } ``` ##### Response (200) ```json { "type": "workspace_member_deleted", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" } ``` ## Workspaces › Service Accounts ### List Service Account Workspace Members `client.Organization.Workspaces.ServiceAccounts.List(ctx, workspaceID, query) (*PageCursor[ServiceAccountWorkspaceMember], error)` **GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go). List the service accounts that are members of a workspace. Each entry includes the service account's `workspace_role`. Use `limit` and the `next_page` cursor to paginate. Archived workspaces return 400; use `GET /service_accounts/{id}/workspaces` to audit memberships of an archived workspace. The implicit default-workspace membership is not included in this list. Memberships of archived service accounts are omitted from the results. #### Parameters - `workspaceID string` (path parameter) ID of the workspace. - `query OrganizationWorkspaceServiceAccountListParams` - `Limit param.Opt[int64] Optional` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `Page param.Opt[string] Optional` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `type ServiceAccountWorkspaceMember` - `Type ServiceAccountWorkspaceMember` default: service_account_workspace_member - `CreatedByActorID string` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `Implicit bool` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `ServiceAccountID string` Tagged service account ID (`svac_...`). - `WorkspaceID string` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"` - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"` - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"` - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"` - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"` #### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) page, err := client.Organization.Workspaces.ServiceAccounts.List( context.TODO(), "workspace_id", anthropic.OrganizationWorkspaceServiceAccountListParams{}, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` ##### Response (200) ```json { "data": [ { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ], "next_page": "next_page" } ``` ### Create Service Account Workspace Member `client.Organization.Workspaces.ServiceAccounts.Add(ctx, workspaceID, body) (*ServiceAccountWorkspaceMember, error)` **POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go). Add a service account to a workspace with the given `workspace_role`. The role determines what the service account can do in the workspace and which workspace-scoped permissions it can be granted when authenticating through federation. Every service account is already an implicit `workspace_user` member of the default workspace; adding it explicitly assigns a chosen role. If the service account is already an explicit member of the workspace, its `workspace_role` is replaced with the value supplied here. Archived workspaces return 400. Archived service accounts cannot be added and are rejected. #### Parameters - `workspaceID string` (path parameter) ID of the workspace. - `body OrganizationWorkspaceServiceAccountAddParams` - `ServiceAccountID string` Tagged service account ID to add. - `WorkspaceRole NoBillingWorkspaceRole` Role to assign to the service account in this workspace. #### Returns - `type ServiceAccountWorkspaceMember` - `Type ServiceAccountWorkspaceMember` default: service_account_workspace_member - `CreatedByActorID string` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `Implicit bool` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `ServiceAccountID string` Tagged service account ID (`svac_...`). - `WorkspaceID string` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"` - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"` - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"` - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"` - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"` #### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) serviceAccountWorkspaceMember, err := client.Organization.Workspaces.ServiceAccounts.Add( context.TODO(), "workspace_id", anthropic.OrganizationWorkspaceServiceAccountAddParams{ ServiceAccountID: "service_account_id", WorkspaceRole: anthropic.NoBillingWorkspaceRoleWorkspaceAdmin, }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", serviceAccountWorkspaceMember.CreatedByActorID) } ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### Get Service Account Workspace Member `client.Organization.Workspaces.ServiceAccounts.Get(ctx, serviceAccountID, query) (*ServiceAccountWorkspaceMember, error)` **GET** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go). Retrieve a service account's membership in a workspace. Returns the membership record, including the service account's `workspace_role` in this workspace. Archived workspaces return 400. For the default workspace, returns the implicit (`implicit: true`) membership when no explicit membership exists; an explicitly added membership is returned with its assigned role. An archived service account returns 404. #### Parameters - `serviceAccountID string` (path parameter) ID of the service account. - `query OrganizationWorkspaceServiceAccountGetParams` - `WorkspaceID string` (path parameter) ID of the workspace. #### Returns - `type ServiceAccountWorkspaceMember` - `Type ServiceAccountWorkspaceMember` default: service_account_workspace_member - `CreatedByActorID string` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `Implicit bool` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `ServiceAccountID string` Tagged service account ID (`svac_...`). - `WorkspaceID string` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"` - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"` - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"` - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"` - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"` #### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) serviceAccountWorkspaceMember, err := client.Organization.Workspaces.ServiceAccounts.Get( context.TODO(), "service_account_id", anthropic.OrganizationWorkspaceServiceAccountGetParams{ WorkspaceID: "workspace_id", }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", serviceAccountWorkspaceMember.CreatedByActorID) } ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### Update Service Account Workspace Member `client.Organization.Workspaces.ServiceAccounts.Update(ctx, serviceAccountID, params) (*ServiceAccountWorkspaceMember, error)` **POST** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go). Change a service account's role in a workspace. The new `workspace_role` replaces the current one. Only explicit memberships can be updated; to set a role on the implicit default-workspace membership, add the service account explicitly with `POST /workspaces/{workspace_id}/service_accounts`. Archived workspaces return 400. Archived service accounts cannot be updated and are rejected. #### Parameters - `serviceAccountID string` (path parameter) ID of the service account. - `params OrganizationWorkspaceServiceAccountUpdateParams` - `WorkspaceID string` (path parameter) ID of the workspace. - `WorkspaceRole NoBillingWorkspaceRole` New role for the service account in this workspace. #### Returns - `type ServiceAccountWorkspaceMember` - `Type ServiceAccountWorkspaceMember` default: service_account_workspace_member - `CreatedByActorID string` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `Implicit bool` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `ServiceAccountID string` Tagged service account ID (`svac_...`). - `WorkspaceID string` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"` - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"` - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"` - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"` - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"` #### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) serviceAccountWorkspaceMember, err := client.Organization.Workspaces.ServiceAccounts.Update( context.TODO(), "service_account_id", anthropic.OrganizationWorkspaceServiceAccountUpdateParams{ WorkspaceID: "workspace_id", WorkspaceRole: anthropic.NoBillingWorkspaceRoleWorkspaceAdmin, }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", serviceAccountWorkspaceMember.CreatedByActorID) } ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### Delete Service Account Workspace Member `client.Organization.Workspaces.ServiceAccounts.Remove(ctx, serviceAccountID, body) (*OrganizationWorkspaceServiceAccountRemoveResponse, error)` **DELETE** `/v1/organizations/workspaces/{workspace_id}/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go). Remove a service account from a workspace. Removal is idempotent (returns 200 even if the membership was already removed). A DELETE against the implicit default-workspace membership returns 200 but is a no-op and the membership persists; deleting an explicit default-workspace row reverts to the implicit `workspace_user` membership. Archived workspaces return 400. #### Parameters - `serviceAccountID string` (path parameter) ID of the service account. - `body OrganizationWorkspaceServiceAccountRemoveParams` - `WorkspaceID string` (path parameter) ID of the workspace. #### Returns - `type OrganizationWorkspaceServiceAccountRemoveResponse` - `Type ServiceAccountWorkspaceMemberDeleted` default: service_account_workspace_member_deleted - `ServiceAccountID string` Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op. - `WorkspaceID string` Tagged workspace ID (`wrkspc_...`) named in the delete request. #### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) serviceAccount, err := client.Organization.Workspaces.ServiceAccounts.Remove( context.TODO(), "service_account_id", anthropic.OrganizationWorkspaceServiceAccountRemoveParams{ WorkspaceID: "workspace_id", }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", serviceAccount.ServiceAccountID) } ``` ##### Response (200) ```json { "service_account_id": "service_account_id", "type": "service_account_workspace_member_deleted", "workspace_id": "workspace_id" } ```