Claude Platform Docs

Perbarui Aturan Federasi

organization.federation.rules.update(federation_rule_id, **kwargs) -> FederationRule
POST/v1/organizations/federation_rules/{federation_rule_id}

Memerlukan token akses OAuth dengan scope org:admin, dari ant auth login --scope org:admin atau aturan workload identity federation; kunci Admin API tidak diterima. Lihat Mengelola WIF dengan Admin API.

Perbarui sebagian aturan federasi.

issuer_id tidak dapat diubah. match dan target diganti sebagai objek utuh saat ditetapkan. Akun layanan dan workspace yang direferensikan harus ada di organisasi Anda; referensi yang tidak valid ditolak dengan error 400. Aturan yang diarsipkan tidak dapat diperbarui; ini mengembalikan 400. Buat aturan baru sebagai gantinya. Aturan pada penerbit bersama yang umum dikenal (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) harus membatasi identitas tenant melalui klaim yang membawa identitas, prefiks subjek yang mengunci tenant (seperti repo:YOUR_ORG/...), atau kondisi CEL yang mereferensikan salah satu klaim identitas tersebut (mis. claims.repository_owner). Pada penerbit ini, persyaratan tersebut diperiksa ulang pada setiap pembaruan; jika match tersimpan dari aturan yang ada belum membatasi identitas tenant, setiap pembaruan (bahkan penggantian nama atau perubahan deskripsi) juga harus menyertakan match yang sesuai dalam permintaan yang sama. Pemanggil OAuth hanya dapat mengelola aturan yang oauth_scope-nya adalah workspace:developer atau workspace:inference; scope lain memerlukan sesi Console.

Parameters
federation_rule_id: str⁠Path parameter

ID of the federation rule to update.

applies_to_all_workspaces: Optional[bool]

When true, enables this rule for every workspace in the org (including workspaces created later). Setting false is rejected with 400 if no workspace would remain enabled; a rule with only a legacy workspace_id binding continues to mint.

description: Optional[str]

Replaces the description. Omit to leave unchanged; send null to clear (the field is stored as an empty string).

maxLength2000
match: Optional[FederationRuleMatchParam]

Replaces the entire match object. All populated matcher fields must pass.

audience: Optional[str]

Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.

maxLength1024
claims: Optional[Dict[str, str]]

Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.

condition: Optional[str]

CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.

maxLength4096
subject_prefix: Optional[str]

Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.

maxLength1024
name: Optional[str]

Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength1
maxLength255
oauth_scope: Optional[str]

Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

minLength1
target: Optional[ServiceAccountTargetParam]

Replaces the entire target object. Currently always a service_account target.

type: Literal["service_account"]
service_account_id: str

Tagged ID of the service account to mint tokens for.

service_account_name: Optional[str]

Service account's display name at read time. Ignored on writes.

token_lifetime_seconds: Optional[int]

Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

minimum60
maximum86400
workspace_id: Optional[str]

Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the /federation_rules/{federation_rule_id}/workspaces sub-resource instead.

Returns
class FederationRule: type: "federation_rule"; id; applies_to_all_workspaces; ... # 15 more

Authorization rule binding an external OIDC identity to Anthropic.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

Perbarui Aturan Federasi
import os
from anthropic import Anthropic

client = Anthropic(
    api_key=os.environ.get(
        "ANTHROPIC_API_KEY"
    ),  # This is the default and can be omitted
)
federation_rule = client.organization.federation.rules.update(
    federation_rule_id="federation_rule_id",
)
print(federation_rule.id)
Returns Examples
Response 200
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}