フェデレーションルールを作成

FederationRule Organization.Federation.Rules.Create(parameters, cancellationToken = default)

POST/v1/organizations/federation_rules

org:adminスコープを持つOAuthアクセストークンが必要です。このトークンはant auth login --scope org:adminまたはワークロードアイデンティティフェデレーションルールから取得します。Admin APIキーは受け付けられません。Admin APIでWIFを管理するを参照してください。

組織が所有するフェデレーションルールを作成します。

参照される発行者と対象のサービスアカウントは、同じ組織内にすでに存在している必要があります。無効な参照は400エラーで拒否されます。ワークスペースの参照は検証されます。ルール作成時にメンバーシップはチェックされません。トークン交換は呼び出しごとに有効なワークスペースを1つ解決し、対象のサービスアカウントがそのワークスペースのメンバーでない限り拒否されます（デフォルトワークスペースには暗黙的にメンバーとなっています）。よく知られた共有発行者（GitHub Actions、GitLab、Buildkite、Terraform Cloud、Google）に対するルールは、アイデンティティを含むクレーム、テナントを固定するサブジェクトプレフィックス（repo:YOUR_ORG/...など）、またはそれらのアイデンティティクレームのいずれかを参照する CEL条件（例：claims.repository_owner）によって、テナントのアイデンティティを制約する必要があります。 OAuth呼び出し元が管理できるのは、oauth_scopeがworkspace:developerまたは workspace:inferenceであるルールのみです。その他のスコープにはConsoleセッションが必要です。

Parameters

RuleCreateParams parameters

required string issuerID

Tagged ID of the federation issuer.

required FederationRuleMatch match

Conditions the verified JWT must satisfy for this rule to apply. At least one of subject_prefix (other than a wildcard-only value like *), claims, or condition is required; audience alone is not sufficient.

required string name

Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength1

maxLength255

required string oauthScope

Space-separated OAuth scopes. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

minLength1

required ServiceAccountTarget target

Identity that tokens minted via this rule act as. Currently always a service_account target.

bool appliesToAllWorkspaces

When true, enable this rule for every workspace in the org (including workspaces created later).

string? description

Optional free-text description.

maxLength2000

long tokenLifetimeSeconds

Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

minimum60

maximum86400

string? workspaceID

Tagged ID of the workspace to enable this rule for. Required unless applies_to_all_workspaces is true. Additional workspaces can be added via the /federation_rules/{federation_rule_id}/workspaces sub-resource.

Returns

class FederationRule { Type = "federation_rule"; ID; AppliesToAllWorkspaces; /* 15 more */ }

Authorization rule binding an external OIDC identity to Anthropic.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

フェデレーションルールを作成

using System;
using System.Collections.Generic;
using Anthropic.Models.Organization.Federation.Rules;

RuleCreateParams parameters = new()
{
    IssuerID = "issuer_id",
    Match = new()
    {
        Audience = "audience",
        Claims = new Dictionary<string, string>() { { "foo", "string" } },
        Condition = "condition",
        SubjectPrefix = "subject_prefix",
    },
    Name = "x",
    OAuthScope = "x",
    Target = new()
    {
        ServiceAccountID = "svac_01SDCCSbTxrXDpWc1phhtcfK",
        ServiceAccountName = "service_account_name",
    },
};

var federationRule = await client.Organization.Federation.Rules.Create(parameters);

Console.WriteLine(federationRule);

Response 200

{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}

Returns Examples

Response 200

{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}