--- title: Service Accounts url: https://platform.claude.com/docs/en/api/go/organization/service_accounts --- # Service Accounts ## Create Service Account `client.Organization.ServiceAccounts.New(ctx, body) (*ServiceAccount, error)` **POST** `/v1/organizations/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go). Create a service account. A service account is a named workload identity that federation rules target. `organization_role` is `developer` (default) or `admin`; a rule may only be created or retargeted to grant `org:admin` scope when the target's `organization_role` is `admin`. Creating an `admin`-role service account requires an interactive credential (a user OAuth token or a Console session) — a workload may only create `developer`-role service accounts. ### Parameters - `body OrganizationServiceAccountNewParams` - `Name string` Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409. minLength: 1, maxLength: 255 - `Description param.Opt[string] Optional` Optional free-text description. maxLength: 2000 - `OrganizationRole OrganizationServiceAccountNewParamsOrganizationRole Optional` Org-level role. Defaults to `developer`. - `const OrganizationServiceAccountNewParamsOrganizationRoleAdmin OrganizationServiceAccountNewParamsOrganizationRole = "admin"` - `const OrganizationServiceAccountNewParamsOrganizationRoleDeveloper OrganizationServiceAccountNewParamsOrganizationRole = "developer"` ### Returns - `type ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `Type ServiceAccount` default: service_account - `ID string` Tagged ID of the service account. - `ArchivedAt Time` If set, this service account is archived. format: date-time - `ArchivedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `CreatedAt Time` When this service account was created. format: date-time - `CreatedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `Description string` Optional free-text description. - `Name string` Admin-chosen slug identifier. - `OrganizationRole ServiceAccountOrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `const ServiceAccountOrganizationRoleAdmin ServiceAccountOrganizationRole = "admin"` - `const ServiceAccountOrganizationRoleDeveloper ServiceAccountOrganizationRole = "developer"` - `UpdatedAt Time` When this service account was last updated. format: date-time - `UpdatedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) serviceAccount, err := client.Organization.ServiceAccounts.New(context.TODO(), anthropic.OrganizationServiceAccountNewParams{ Name: "ci-deploy-bot", }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", serviceAccount.ID) } ``` #### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## List Service Accounts `client.Organization.ServiceAccounts.List(ctx, query) (*PageCursor[ServiceAccount], error)` **GET** `/v1/organizations/service_accounts` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go). List service accounts in the caller's organization. Results are ordered by creation time, newest first. Use `limit` and the `next_page` cursor to paginate; set `include_archived=true` to include archived service accounts. ### Parameters - `query OrganizationServiceAccountListParams` - `IncludeArchived param.Opt[bool] Optional` (query parameter) Include archived resources. Defaults to false. - `Limit param.Opt[int64] Optional` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `Page param.Opt[string] Optional` (query parameter) Opaque cursor from a previous response's `next_page`. ### Returns - `type ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `Type ServiceAccount` default: service_account - `ID string` Tagged ID of the service account. - `ArchivedAt Time` If set, this service account is archived. format: date-time - `ArchivedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `CreatedAt Time` When this service account was created. format: date-time - `CreatedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `Description string` Optional free-text description. - `Name string` Admin-chosen slug identifier. - `OrganizationRole ServiceAccountOrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `const ServiceAccountOrganizationRoleAdmin ServiceAccountOrganizationRole = "admin"` - `const ServiceAccountOrganizationRoleDeveloper ServiceAccountOrganizationRole = "developer"` - `UpdatedAt Time` When this service account was last updated. format: date-time - `UpdatedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) page, err := client.Organization.ServiceAccounts.List(context.TODO(), anthropic.OrganizationServiceAccountListParams{}) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` #### Response (200) ```json { "data": [ { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ], "next_page": "next_page" } ``` ## Get Service Account `client.Organization.ServiceAccounts.Get(ctx, serviceAccountID) (*ServiceAccount, error)` **GET** `/v1/organizations/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go). Retrieve a service account by its ID (`svac_...`). ### Parameters - `serviceAccountID string` (path parameter) ID of the service account. ### Returns - `type ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `Type ServiceAccount` default: service_account - `ID string` Tagged ID of the service account. - `ArchivedAt Time` If set, this service account is archived. format: date-time - `ArchivedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `CreatedAt Time` When this service account was created. format: date-time - `CreatedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `Description string` Optional free-text description. - `Name string` Admin-chosen slug identifier. - `OrganizationRole ServiceAccountOrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `const ServiceAccountOrganizationRoleAdmin ServiceAccountOrganizationRole = "admin"` - `const ServiceAccountOrganizationRoleDeveloper ServiceAccountOrganizationRole = "developer"` - `UpdatedAt Time` When this service account was last updated. format: date-time - `UpdatedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) serviceAccount, err := client.Organization.ServiceAccounts.Get(context.TODO(), "service_account_id") if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", serviceAccount.ID) } ``` #### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Update Service Account `client.Organization.ServiceAccounts.Update(ctx, serviceAccountID, body) (*ServiceAccount, error)` **POST** `/v1/organizations/service_accounts/{service_account_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go). Update a service account. Only `description` and `organization_role` are mutable; `name` cannot be changed. Archived service accounts cannot be updated; this returns 400. Setting `organization_role` to `admin` (even when unchanged) requires an interactive credential (a user OAuth token or a Console session). ### Parameters - `serviceAccountID string` (path parameter) ID of the service account to update. - `body OrganizationServiceAccountUpdateParams` - `Description param.Opt[string] Optional` Replaces the description. Omit to leave unchanged; send `null` to clear (the field is stored as an empty string). maxLength: 2000 - `OrganizationRole OrganizationServiceAccountUpdateParamsOrganizationRole Optional` Replaces the org-level role. Omit or send `null` to leave unchanged. - `const OrganizationServiceAccountUpdateParamsOrganizationRoleAdmin OrganizationServiceAccountUpdateParamsOrganizationRole = "admin"` - `const OrganizationServiceAccountUpdateParamsOrganizationRoleDeveloper OrganizationServiceAccountUpdateParamsOrganizationRole = "developer"` ### Returns - `type ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `Type ServiceAccount` default: service_account - `ID string` Tagged ID of the service account. - `ArchivedAt Time` If set, this service account is archived. format: date-time - `ArchivedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `CreatedAt Time` When this service account was created. format: date-time - `CreatedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `Description string` Optional free-text description. - `Name string` Admin-chosen slug identifier. - `OrganizationRole ServiceAccountOrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `const ServiceAccountOrganizationRoleAdmin ServiceAccountOrganizationRole = "admin"` - `const ServiceAccountOrganizationRoleDeveloper ServiceAccountOrganizationRole = "developer"` - `UpdatedAt Time` When this service account was last updated. format: date-time - `UpdatedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) serviceAccount, err := client.Organization.ServiceAccounts.Update( context.TODO(), "service_account_id", anthropic.OrganizationServiceAccountUpdateParams{}, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", serviceAccount.ID) } ``` #### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Archive Service Account `client.Organization.ServiceAccounts.Archive(ctx, serviceAccountID) (*ServiceAccount, error)` **POST** `/v1/organizations/service_accounts/{service_account_id}/archive` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go). Archive a service account. Idempotent; re-archiving returns the service account with its original `archived_at`. Rejected with 400 if any live (non-archived) federation rule still targets this service account, same as issuer archival; archive those rules first or change their target to another service account. ### Parameters - `serviceAccountID string` (path parameter) ID of the service account to archive. ### Returns - `type ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `Type ServiceAccount` default: service_account - `ID string` Tagged ID of the service account. - `ArchivedAt Time` If set, this service account is archived. format: date-time - `ArchivedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `CreatedAt Time` When this service account was created. format: date-time - `CreatedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `Description string` Optional free-text description. - `Name string` Admin-chosen slug identifier. - `OrganizationRole ServiceAccountOrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `const ServiceAccountOrganizationRoleAdmin ServiceAccountOrganizationRole = "admin"` - `const ServiceAccountOrganizationRoleDeveloper ServiceAccountOrganizationRole = "developer"` - `UpdatedAt Time` When this service account was last updated. format: date-time - `UpdatedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. ### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) serviceAccount, err := client.Organization.ServiceAccounts.Archive(context.TODO(), "service_account_id") if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", serviceAccount.ID) } ``` #### Response (200) ```json { "id": "svac_01SDCCSbTxrXDpWc1phhtcfK", "archived_at": "2019-12-27T18:11:19.117Z", "archived_by_actor_id": "archived_by_actor_id", "created_at": "2024-10-30T23:58:27.427722Z", "created_by_actor_id": "created_by_actor_id", "description": "description", "name": "ci-deploy-bot", "organization_role": "admin", "type": "service_account", "updated_at": "2024-10-30T23:58:27.427722Z", "updated_by_actor_id": "updated_by_actor_id" } ``` ## Domain types ### Service Account - `type ServiceAccount` Named non-human identity within the caller's organization. A service account is a pure identity: name + org. Authorization lives on whatever references it (federation rules). - `Type ServiceAccount` default: service_account - `ID string` Tagged ID of the service account. - `ArchivedAt Time` If set, this service account is archived. format: date-time - `ArchivedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that archived this service account. - `CreatedAt Time` When this service account was created. format: date-time - `CreatedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that created this service account. - `Description string` Optional free-text description. - `Name string` Admin-chosen slug identifier. - `OrganizationRole ServiceAccountOrganizationRole` Org-level role. A federation rule may only be created or retargeted to grant `org:admin` scope when this is `admin`. A rule granting `org:admin` whose target is later demoted to `developer` is rejected at token exchange. Rules granting `org:admin` are managed in the Console. - `const ServiceAccountOrganizationRoleAdmin ServiceAccountOrganizationRole = "admin"` - `const ServiceAccountOrganizationRoleDeveloper ServiceAccountOrganizationRole = "developer"` - `UpdatedAt Time` When this service account was last updated. format: date-time - `UpdatedByActorID string` Tagged ID (`user_`/`svac_`) of the actor that last updated this service account. ### Service Account Workspace Member - `type ServiceAccountWorkspaceMember` - `Type ServiceAccountWorkspaceMember` default: service_account_workspace_member - `CreatedByActorID string` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `Implicit bool` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `ServiceAccountID string` Tagged service account ID (`svac_...`). - `WorkspaceID string` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"` - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"` - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"` - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"` - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"` ## Service Accounts › Workspaces ### Add Workspace To Service Account `client.Organization.ServiceAccounts.Workspaces.Add(ctx, serviceAccountID, body) (*ServiceAccountWorkspaceMember, error)` **POST** `/v1/organizations/service_accounts/{service_account_id}/workspaces` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go). Add a service account to a workspace with the given `workspace_role`. Mirror of `POST /workspaces/{workspace_id}/service_accounts`, addressed from the service-account side; both create the same membership. If the service account is already an explicit member of the workspace, its `workspace_role` is replaced with the value supplied here. Archived workspaces return 400. Archived service accounts cannot be added and are rejected. #### Parameters - `serviceAccountID string` (path parameter) ID of the service account. - `body OrganizationServiceAccountWorkspaceAddParams` - `WorkspaceID string` Tagged workspace ID to add the service account to. - `WorkspaceRole NoBillingWorkspaceRole` Role to assign to the service account in this workspace. #### Returns - `type ServiceAccountWorkspaceMember` - `Type ServiceAccountWorkspaceMember` default: service_account_workspace_member - `CreatedByActorID string` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `Implicit bool` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `ServiceAccountID string` Tagged service account ID (`svac_...`). - `WorkspaceID string` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"` - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"` - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"` - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"` - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"` #### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) serviceAccountWorkspaceMember, err := client.Organization.ServiceAccounts.Workspaces.Add( context.TODO(), "service_account_id", anthropic.OrganizationServiceAccountWorkspaceAddParams{ WorkspaceID: "workspace_id", WorkspaceRole: anthropic.NoBillingWorkspaceRoleWorkspaceAdmin, }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", serviceAccountWorkspaceMember.CreatedByActorID) } ``` ##### Response (200) ```json { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ``` ### List Workspaces For Service Account `client.Organization.ServiceAccounts.Workspaces.List(ctx, serviceAccountID, query) (*PageCursor[ServiceAccountWorkspaceMember], error)` **GET** `/v1/organizations/service_accounts/{service_account_id}/workspaces` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go). List the workspaces a service account is a member of. Each entry includes the service account's `workspace_role` in that workspace. Use `limit` and the `next_page` cursor to paginate. When the service account has no explicit default-workspace membership, the implicit (`implicit: true`) membership is returned as the first entry on the first page; with `limit=1` the first page may return up to 2 entries (the implicit entry plus one explicit membership) so a pagination cursor can be derived. Memberships are returned only while the service account is active. Without a `page` cursor, an archived service account returns an empty list. A `page` cursor that does not match an active membership returns a 400 invalid-request error. A cursor stops matching when the membership is removed, the workspace is deleted, or the service account is archived. Restart pagination from the first page to recover. #### Parameters - `serviceAccountID string` (path parameter) ID of the service account. - `query OrganizationServiceAccountWorkspaceListParams` - `Limit param.Opt[int64] Optional` (query parameter) Number of results per page. minimum: 1, maximum: 100 - `Page param.Opt[string] Optional` (query parameter) Opaque cursor from a previous response's `next_page`. #### Returns - `type ServiceAccountWorkspaceMember` - `Type ServiceAccountWorkspaceMember` default: service_account_workspace_member - `CreatedByActorID string` Tagged ID (`user_...`/`svac_...`) of the actor who created this membership. - `Implicit bool` True when this is the implicit default-workspace membership every service account has when no explicit membership exists. Implicit memberships have role `workspace_user` and cannot be removed. - `ServiceAccountID string` Tagged service account ID (`svac_...`). - `WorkspaceID string` Tagged workspace ID (`wrkspc_...`). - `WorkspaceRole WorkspaceRole` Role of the service account in this workspace. Service accounts cannot hold the `workspace_billing` role. - `const WorkspaceRoleWorkspaceAdmin WorkspaceRole = "workspace_admin"` - `const WorkspaceRoleWorkspaceBilling WorkspaceRole = "workspace_billing"` - `const WorkspaceRoleWorkspaceDeveloper WorkspaceRole = "workspace_developer"` - `const WorkspaceRoleWorkspaceRestrictedDeveloper WorkspaceRole = "workspace_restricted_developer"` - `const WorkspaceRoleWorkspaceUser WorkspaceRole = "workspace_user"` #### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) page, err := client.Organization.ServiceAccounts.Workspaces.List( context.TODO(), "service_account_id", anthropic.OrganizationServiceAccountWorkspaceListParams{}, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", page) } ``` ##### Response (200) ```json { "data": [ { "created_by_actor_id": "created_by_actor_id", "implicit": true, "service_account_id": "service_account_id", "type": "service_account_workspace_member", "workspace_id": "workspace_id", "workspace_role": "workspace_admin" } ], "next_page": "next_page" } ``` ### Remove Workspace From Service Account `client.Organization.ServiceAccounts.Workspaces.Remove(ctx, workspaceID, body) (*OrganizationServiceAccountWorkspaceRemoveResponse, error)` **DELETE** `/v1/organizations/service_accounts/{service_account_id}/workspaces/{workspace_id}` **Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](https://platform.claude.com/docs/en/manage-claude/wif-admin-api?sdk_languages=go). Remove a service account from a workspace. Mirror of `DELETE /workspaces/{workspace_id}/service_accounts/{service_account_id}`, addressed from the service-account side. Removal is idempotent (returns 200 even if the membership was already removed). A DELETE against the implicit default-workspace membership returns 200 but is a no-op and the membership persists; deleting an explicit default-workspace row reverts to the implicit `workspace_user` membership. Archived workspaces return 400. #### Parameters - `workspaceID string` (path parameter) ID of the workspace. - `body OrganizationServiceAccountWorkspaceRemoveParams` - `ServiceAccountID string` (path parameter) ID of the service account. #### Returns - `type OrganizationServiceAccountWorkspaceRemoveResponse` - `Type ServiceAccountWorkspaceMemberDeleted` default: service_account_workspace_member_deleted - `ServiceAccountID string` Tagged service account ID (`svac_...`) named in the delete request. Removal is idempotent; see the endpoint description for the implicit-membership no-op. - `WorkspaceID string` Tagged workspace ID (`wrkspc_...`) named in the delete request. #### Example ```go package main import ( "context" "fmt" "github.com/anthropics/anthropic-sdk-go" "github.com/anthropics/anthropic-sdk-go/option" ) func main() { client := anthropic.NewClient( option.WithAPIKey("my-anthropic-api-key"), ) workspace, err := client.Organization.ServiceAccounts.Workspaces.Remove( context.TODO(), "workspace_id", anthropic.OrganizationServiceAccountWorkspaceRemoveParams{ ServiceAccountID: "service_account_id", }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", workspace.ServiceAccountID) } ``` ##### Response (200) ```json { "service_account_id": "service_account_id", "type": "service_account_workspace_member_deleted", "workspace_id": "workspace_id" } ```