Claude Platform Docs

フェデレーションルールを更新

POST/v1/organizations/federation_rules/{federation_rule_id}

フェデレーションルールを部分的に更新します。

issuer_id は変更できません。match と target は、設定するとオブジェクト全体が置き換えられます。参照されるサービスアカウントとワークスペースは組織内に存在している必要があります。無効な参照は400エラーで拒否されます。アーカイブ済みのルールは更新できず、400を返します。代わりに新しいルールを作成してください。よく知られた共有発行者（GitHub Actions、GitLab、Buildkite、Terraform Cloud、Google）に対するルールは、IDを含むクレーム、テナントを固定するサブジェクトプレフィックス（repo:YOUR_ORG/... など）、またはそれらのIDクレームのいずれかを参照するCEL条件（例: claims.repository_owner）によってテナントIDを制約する必要があります。これらの発行者では、この要件は更新のたびに再チェックされます。既存のルールに保存されているmatchがまだテナントIDを制約していない場合、どのような更新（名前の変更や説明の変更であっても）でも、同じリクエスト内で要件に適合する match を指定する必要があります。OAuth呼び出し元が管理できるのは、oauth_scope が workspace:developer または workspace:inference のルールのみです。その他のスコープにはConsoleセッションが必要です。Admin APIキーは受け付けられません。

Path parameters
federation_rule_id: string

ID of the federation rule to update.

Headers
"anthropic-beta": optional array of string

Optional header to specify the beta version(s) you want to use.

To use multiple betas, use a comma separated list like beta1,beta2 or specify the header multiple times for each beta.

Body
applies_to_all_workspaces: optional boolean or null

When true, enables this rule for every workspace in the org (including workspaces created later). Setting false is rejected with 400 if no workspace would remain enabled; a rule with only a legacy workspace_id binding continues to mint.

attributes: optional map[string] or null

Replaces the CEL expressions {name: expr} extracting named values from claims. Send null to clear them. Not yet supported; any non-empty value is rejected with 400.

description: optional string or null

Replaces the description. Omit to leave unchanged; send null to clear (the field is stored as an empty string).

maxLength2000
match: optional object{ audience, claims, condition, subject_prefix } or null

Does the incoming JWT qualify?

All populated fields must pass; omitted fields are skipped. At least one of subject_prefix (other than a wildcard-only value like *), claims, or condition is required; audience alone is not sufficient.

audience: optional string or null

Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.

maxLength1024
claims: optional map[string] or null

Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.

condition: optional string or null

CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.

maxLength4096
subject_prefix: optional string or null

Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.

maxLength1024
name: optional string or null

Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

maxLength255
minLength1
oauth_scope: optional string or null

Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

minLength1
target: optional object{ service_account_id, type, service_account_name } or null

Bind to a fixed service account by ID.

service_account_id: string

Tagged ID of the service account to mint tokens for.

type: "service_account"
service_account_name: optional string or null

Service account's display name at read time. Ignored on writes.

token_lifetime_seconds: optional number or null

Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

maximum86400
minimum60
workspace_id: optional string or null

Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the /federation_rules/{federation_rule_id}/workspaces sub-resource instead.

Returns
FederationRule object{ id, applies_to_all_workspaces, archived_at, 17 more }

Authorization rule binding an external OIDC identity to Anthropic.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

フェデレーションルールを更新
cURL
curl https://api.anthropic.com/v1/organizations/federation_rules/$FEDERATION_RULE_ID \
    -H 'Content-Type: application/json' \
    -H 'anthropic-version: 2023-06-01' \
    -H "Authorization: Bearer $ANTHROPIC_OAUTH_TOKEN" \
    -d '{}'
Returns Examples
Response 200
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}