---
title: RBAC Groups
url: https://platform.claude.com/docs/en/api/java/beta/organization/rbac_groups
---

# RBAC Groups

## Create RBAC Group

`BetaRbacGroup beta().organization().rbacGroups().create(params, requestOptions = RequestOptions.none())`

**POST** `/v1/organizations/rbac_groups`

Create an RBAC Group in the Claude Enterprise tenant. Groups created via the API have source type `"direct"`.

The RBAC Groups API is available to Claude Enterprise organizations only.

### Parameters

- `RbacGroupCreateParams params`

  - `String name`

    Name of the RBAC Group. Not uniqueness-enforced.

    minLength: 1, maxLength: 255

### Returns

- `class BetaRbacGroup`

  - `JsonValue type = "rbac_group"`

    Object type.

    For RBAC Groups, this is always `"rbac_group"`.

  - `String id`

    ID of the RBAC Group.

  - `LocalDateTime createdAt`

    RFC 3339 timestamp of when the RBAC Group was created.

    format: date-time

  - `String name`

    Name of the RBAC Group. Not uniqueness-enforced.

  - `Optional<List<String>> roleIds`

    RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.

  - `SourceType sourceType`

    How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.

    - `DIRECT("direct")`

    - `SCIM("scim")`

  - `LocalDateTime updatedAt`

    RFC 3339 timestamp of when the RBAC Group was last updated.

    format: date-time

### Example

```java
package com.anthropic.example;

import com.anthropic.client.AnthropicClient;
import com.anthropic.client.okhttp.AnthropicOkHttpClient;
import com.anthropic.models.beta.organization.rbacgroups.BetaRbacGroup;
import com.anthropic.models.beta.organization.rbacgroups.RbacGroupCreateParams;

public final class Main {
    private Main() {}

    public static void main(String[] args) {
        AnthropicClient client = AnthropicOkHttpClient.fromEnv();

        RbacGroupCreateParams params = RbacGroupCreateParams.builder()
            .name("Engineering")
            .build();
        BetaRbacGroup betaRbacGroup = client.beta().organization().rbacGroups().create(params);
    }
}
```

#### Response (200)

```json
{
  "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "name": "Engineering",
  "role_ids": [
    "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
  ],
  "roles": [
    "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
  ],
  "source_type": "direct",
  "type": "rbac_group",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}
```

## List RBAC Groups

`RbacGroupListPage beta().organization().rbacGroups().list(params = RbacGroupListParams.none(), requestOptions = RequestOptions.none())`

**GET** `/v1/organizations/rbac_groups`

List RBAC Groups in the Claude Enterprise tenant.

The RBAC Groups API is available to Claude Enterprise organizations only.

### Parameters

- `RbacGroupListParams params`

  - `Optional<Long> limit` (query parameter)

    Number of items to return per page.

    Defaults to `20`. Ranges from `1` to `1000`.

    minimum: 1, maximum: 1000

  - `Optional<String> page` (query parameter)

    Optionally set to the `next_page` token from the previous response.

### Returns

- `class BetaRbacGroup`

  - `JsonValue type = "rbac_group"`

    Object type.

    For RBAC Groups, this is always `"rbac_group"`.

  - `String id`

    ID of the RBAC Group.

  - `LocalDateTime createdAt`

    RFC 3339 timestamp of when the RBAC Group was created.

    format: date-time

  - `String name`

    Name of the RBAC Group. Not uniqueness-enforced.

  - `Optional<List<String>> roleIds`

    RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.

  - `SourceType sourceType`

    How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.

    - `DIRECT("direct")`

    - `SCIM("scim")`

  - `LocalDateTime updatedAt`

    RFC 3339 timestamp of when the RBAC Group was last updated.

    format: date-time

### Example

```java
package com.anthropic.example;

import com.anthropic.client.AnthropicClient;
import com.anthropic.client.okhttp.AnthropicOkHttpClient;
import com.anthropic.models.beta.organization.rbacgroups.RbacGroupListPage;
import com.anthropic.models.beta.organization.rbacgroups.RbacGroupListParams;

public final class Main {
    private Main() {}

    public static void main(String[] args) {
        AnthropicClient client = AnthropicOkHttpClient.fromEnv();

        RbacGroupListPage page = client.beta().organization().rbacGroups().list();
    }
}
```

#### Response (200)

```json
{
  "data": [
    {
      "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
      "created_at": "2024-10-30T23:58:27.427722Z",
      "name": "Engineering",
      "role_ids": [
        "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
      ],
      "roles": [
        "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
      ],
      "source_type": "direct",
      "type": "rbac_group",
      "updated_at": "2024-10-30T23:58:27.427722Z"
    }
  ],
  "has_more": false,
  "next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9"
}
```

## Get RBAC Group

`BetaRbacGroup beta().organization().rbacGroups().retrieve(params = RbacGroupRetrieveParams.none(), requestOptions = RequestOptions.none())`

**GET** `/v1/organizations/rbac_groups/{rbac_group_id}`

Retrieve an RBAC Group by ID.

The RBAC Groups API is available to Claude Enterprise organizations only.

### Parameters

- `RbacGroupRetrieveParams params`

  - `Optional<String> rbacGroupId` (path parameter)

    ID of the RBAC Group.

### Returns

- `class BetaRbacGroup`

  - `JsonValue type = "rbac_group"`

    Object type.

    For RBAC Groups, this is always `"rbac_group"`.

  - `String id`

    ID of the RBAC Group.

  - `LocalDateTime createdAt`

    RFC 3339 timestamp of when the RBAC Group was created.

    format: date-time

  - `String name`

    Name of the RBAC Group. Not uniqueness-enforced.

  - `Optional<List<String>> roleIds`

    RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.

  - `SourceType sourceType`

    How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.

    - `DIRECT("direct")`

    - `SCIM("scim")`

  - `LocalDateTime updatedAt`

    RFC 3339 timestamp of when the RBAC Group was last updated.

    format: date-time

### Example

```java
package com.anthropic.example;

import com.anthropic.client.AnthropicClient;
import com.anthropic.client.okhttp.AnthropicOkHttpClient;
import com.anthropic.models.beta.organization.rbacgroups.BetaRbacGroup;
import com.anthropic.models.beta.organization.rbacgroups.RbacGroupRetrieveParams;

public final class Main {
    private Main() {}

    public static void main(String[] args) {
        AnthropicClient client = AnthropicOkHttpClient.fromEnv();

        BetaRbacGroup betaRbacGroup = client.beta().organization().rbacGroups().retrieve("rbac_group_id");
    }
}
```

#### Response (200)

```json
{
  "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "name": "Engineering",
  "role_ids": [
    "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
  ],
  "roles": [
    "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
  ],
  "source_type": "direct",
  "type": "rbac_group",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}
```

## Update RBAC Group

`BetaRbacGroup beta().organization().rbacGroups().update(params = RbacGroupUpdateParams.none(), requestOptions = RequestOptions.none())`

**POST** `/v1/organizations/rbac_groups/{rbac_group_id}`

Update an RBAC Group's name. Groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

The RBAC Groups API is available to Claude Enterprise organizations only.

### Parameters

- `RbacGroupUpdateParams params`

  - `Optional<String> rbacGroupId` (path parameter)

    ID of the RBAC Group.

  - `Optional<String> name`

    Name of the RBAC Group. Not uniqueness-enforced.

    minLength: 1, maxLength: 255

### Returns

- `class BetaRbacGroup`

  - `JsonValue type = "rbac_group"`

    Object type.

    For RBAC Groups, this is always `"rbac_group"`.

  - `String id`

    ID of the RBAC Group.

  - `LocalDateTime createdAt`

    RFC 3339 timestamp of when the RBAC Group was created.

    format: date-time

  - `String name`

    Name of the RBAC Group. Not uniqueness-enforced.

  - `Optional<List<String>> roleIds`

    RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.

  - `SourceType sourceType`

    How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.

    - `DIRECT("direct")`

    - `SCIM("scim")`

  - `LocalDateTime updatedAt`

    RFC 3339 timestamp of when the RBAC Group was last updated.

    format: date-time

### Example

```java
package com.anthropic.example;

import com.anthropic.client.AnthropicClient;
import com.anthropic.client.okhttp.AnthropicOkHttpClient;
import com.anthropic.models.beta.organization.rbacgroups.BetaRbacGroup;
import com.anthropic.models.beta.organization.rbacgroups.RbacGroupUpdateParams;

public final class Main {
    private Main() {}

    public static void main(String[] args) {
        AnthropicClient client = AnthropicOkHttpClient.fromEnv();

        BetaRbacGroup betaRbacGroup = client.beta().organization().rbacGroups().update("rbac_group_id");
    }
}
```

#### Response (200)

```json
{
  "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "name": "Engineering",
  "role_ids": [
    "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
  ],
  "roles": [
    "rbac_role_016J8xVtKpDq3Wy9ZmN2hR4s"
  ],
  "source_type": "direct",
  "type": "rbac_group",
  "updated_at": "2024-10-30T23:58:27.427722Z"
}
```

## Delete RBAC Group

`RbacGroupDeleteResponse beta().organization().rbacGroups().delete(params = RbacGroupDeleteParams.none(), requestOptions = RequestOptions.none())`

**DELETE** `/v1/organizations/rbac_groups/{rbac_group_id}`

Delete an RBAC Group. Groups provisioned by an identity provider (source type `"scim"`) cannot be deleted via the API while an organization in the tenant uses SCIM provisioning.

The RBAC Groups API is available to Claude Enterprise organizations only.

### Parameters

- `RbacGroupDeleteParams params`

  - `Optional<String> rbacGroupId` (path parameter)

    ID of the RBAC Group.

### Returns

- `class RbacGroupDeleteResponse`

  - `JsonValue type = "rbac_group_deleted"`

    Deleted object type.

    For RBAC Groups, this is always `"rbac_group_deleted"`.

  - `String id`

    ID of the RBAC Group.

### Example

```java
package com.anthropic.example;

import com.anthropic.client.AnthropicClient;
import com.anthropic.client.okhttp.AnthropicOkHttpClient;
import com.anthropic.models.beta.organization.rbacgroups.RbacGroupDeleteParams;
import com.anthropic.models.beta.organization.rbacgroups.RbacGroupDeleteResponse;

public final class Main {
    private Main() {}

    public static void main(String[] args) {
        AnthropicClient client = AnthropicOkHttpClient.fromEnv();

        RbacGroupDeleteResponse rbacGroup = client.beta().organization().rbacGroups().delete("rbac_group_id");
    }
}
```

#### Response (200)

```json
{
  "id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
  "type": "rbac_group_deleted"
}
```

## Domain types

### Beta RBAC Group

- `class BetaRbacGroup`

  - `JsonValue type = "rbac_group"`

    Object type.

    For RBAC Groups, this is always `"rbac_group"`.

  - `String id`

    ID of the RBAC Group.

  - `LocalDateTime createdAt`

    RFC 3339 timestamp of when the RBAC Group was created.

    format: date-time

  - `String name`

    Name of the RBAC Group. Not uniqueness-enforced.

  - `Optional<List<String>> roleIds`

    RBAC Role IDs attached to this RBAC Group. Role attachment is managed in the admin settings and is read-only on this API. `null` means role data was temporarily unavailable — retry to distinguish from an empty list.

  - `SourceType sourceType`

    How the RBAC Group was created: `"direct"` for groups created directly (for example, in the organization's admin settings), `"scim"` for groups provisioned by the identity provider.

    - `DIRECT("direct")`

    - `SCIM("scim")`

  - `LocalDateTime updatedAt`

    RFC 3339 timestamp of when the RBAC Group was last updated.

    format: date-time

## RBAC Groups › Members

### List RBAC Group Members

`MemberListPage beta().organization().rbacGroups().members().list(params = MemberListParams.none(), requestOptions = RequestOptions.none())`

**GET** `/v1/organizations/rbac_groups/{rbac_group_id}/members`

List members of an RBAC Group.

The RBAC Groups API is available to Claude Enterprise organizations only.

#### Parameters

- `MemberListParams params`

  - `Optional<String> rbacGroupId` (path parameter)

    ID of the RBAC Group.

  - `Optional<Long> limit` (query parameter)

    Number of items to return per page.

    Defaults to `20`. Ranges from `1` to `1000`.

    minimum: 1, maximum: 1000

  - `Optional<String> page` (query parameter)

    Optionally set to the `next_page` token from the previous response.

#### Returns

- `class BetaRbacGroupMember`

  - `JsonValue type = "rbac_group_member"`

    Object type.

    For RBAC Group Members, this is always `"rbac_group_member"`.

  - `LocalDateTime createdAt`

    RFC 3339 timestamp of when the User was added to the RBAC Group.

    format: date-time

  - `String email`

    Email of the User.

  - `String rbacGroupId`

    ID of the RBAC Group.

  - `String userId`

    ID of the User.

#### Example

```java
package com.anthropic.example;

import com.anthropic.client.AnthropicClient;
import com.anthropic.client.okhttp.AnthropicOkHttpClient;
import com.anthropic.models.beta.organization.rbacgroups.members.MemberListPage;
import com.anthropic.models.beta.organization.rbacgroups.members.MemberListParams;

public final class Main {
    private Main() {}

    public static void main(String[] args) {
        AnthropicClient client = AnthropicOkHttpClient.fromEnv();

        MemberListPage page = client.beta().organization().rbacGroups().members().list("rbac_group_id");
    }
}
```

##### Response (200)

```json
{
  "data": [
    {
      "created_at": "2024-10-30T23:58:27.427722Z",
      "email": "user@emaildomain.com",
      "group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
      "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
      "type": "rbac_group_member",
      "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
    }
  ],
  "has_more": false,
  "next_page": "eyJjdXJzb3IiOiAicmJhY19ncm91cF8wMSJ9"
}
```

### Add RBAC Group Member

`BetaRbacGroupMember beta().organization().rbacGroups().members().add(params, requestOptions = RequestOptions.none())`

**POST** `/v1/organizations/rbac_groups/{rbac_group_id}/members`

Add a User to an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

The RBAC Groups API is available to Claude Enterprise organizations only.

#### Parameters

- `MemberAddParams params`

  - `Optional<String> rbacGroupId` (path parameter)

    ID of the RBAC Group.

  - `String userId`

    ID of the User.

#### Returns

- `class BetaRbacGroupMember`

  - `JsonValue type = "rbac_group_member"`

    Object type.

    For RBAC Group Members, this is always `"rbac_group_member"`.

  - `LocalDateTime createdAt`

    RFC 3339 timestamp of when the User was added to the RBAC Group.

    format: date-time

  - `String email`

    Email of the User.

  - `String rbacGroupId`

    ID of the RBAC Group.

  - `String userId`

    ID of the User.

#### Example

```java
package com.anthropic.example;

import com.anthropic.client.AnthropicClient;
import com.anthropic.client.okhttp.AnthropicOkHttpClient;
import com.anthropic.models.beta.organization.rbacgroups.members.BetaRbacGroupMember;
import com.anthropic.models.beta.organization.rbacgroups.members.MemberAddParams;

public final class Main {
    private Main() {}

    public static void main(String[] args) {
        AnthropicClient client = AnthropicOkHttpClient.fromEnv();

        MemberAddParams params = MemberAddParams.builder()
            .rbacGroupId("rbac_group_id")
            .userId("user_01WCz1FkmYMm4gnmykNKUu3Q")
            .build();
        BetaRbacGroupMember betaRbacGroupMember = client.beta().organization().rbacGroups().members().add(params);
    }
}
```

##### Response (200)

```json
{
  "created_at": "2024-10-30T23:58:27.427722Z",
  "email": "user@emaildomain.com",
  "group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
  "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
  "type": "rbac_group_member",
  "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}
```

### Remove RBAC Group Member

`MemberRemoveResponse beta().organization().rbacGroups().members().remove(params, requestOptions = RequestOptions.none())`

**DELETE** `/v1/organizations/rbac_groups/{rbac_group_id}/members/{user_id}`

Remove a User from an RBAC Group. Membership of groups provisioned by an identity provider (source type `"scim"`) cannot be modified via the API while an organization in the tenant uses SCIM provisioning.

The RBAC Groups API is available to Claude Enterprise organizations only.

#### Parameters

- `MemberRemoveParams params`

  - `String rbacGroupId` (path parameter)

    ID of the RBAC Group.

  - `Optional<String> userId` (path parameter)

    ID of the User.

#### Returns

- `class MemberRemoveResponse`

  - `JsonValue type = "rbac_group_member_deleted"`

    Deleted object type. For RBAC Group Members, this is always `"rbac_group_member_deleted"`.

  - `String rbacGroupId`

    ID of the RBAC Group.

  - `String userId`

    ID of the User.

#### Example

```java
package com.anthropic.example;

import com.anthropic.client.AnthropicClient;
import com.anthropic.client.okhttp.AnthropicOkHttpClient;
import com.anthropic.models.beta.organization.rbacgroups.members.MemberRemoveParams;
import com.anthropic.models.beta.organization.rbacgroups.members.MemberRemoveResponse;

public final class Main {
    private Main() {}

    public static void main(String[] args) {
        AnthropicClient client = AnthropicOkHttpClient.fromEnv();

        MemberRemoveParams params = MemberRemoveParams.builder()
            .rbacGroupId("rbac_group_id")
            .userId("user_id")
            .build();
        MemberRemoveResponse member = client.beta().organization().rbacGroups().members().remove(params);
    }
}
```

##### Response (200)

```json
{
  "group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
  "rbac_group_id": "rbac_group_012rppKaSVsmTo6NqRDXQXNF",
  "type": "rbac_group_member_deleted",
  "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
}
```