Claude Platform Docs

페더레이션 규칙 생성

POST/v1/organizations/federation_rules

org:admin 범위의 OAuth 액세스 토큰이 필요합니다. 이 토큰은 ant auth login --scope org:admin 또는 워크로드 ID 페더레이션 규칙을 통해 얻을 수 있으며, Admin API 키는 허용되지 않습니다. Admin API로 WIF 관리를 참조하세요.

조직이 소유하는 페더레이션 규칙을 생성합니다.

참조된 발급자와 대상 서비스 계정은 동일한 조직에 이미 존재해야 하며, 잘못된 참조는 400 오류로 거부됩니다. 워크스페이스 참조는 검증됩니다. 멤버십은 규칙 생성 시 확인되지 않습니다. 토큰 교환은 호출당 하나의 활성화된 워크스페이스를 확인하며, 대상 서비스 계정이 해당 워크스페이스의 멤버가 아니면 거부됩니다(기본 워크스페이스에는 암묵적으로 멤버입니다). 잘 알려진 공유 발급자(GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google)에 대한 규칙은 ID를 담은 클레임, 테넌트를 고정하는 subject 접두사 (예: repo:YOUR_ORG/...), 또는 이러한 ID 클레임 중 하나를 참조하는 CEL 조건 (예: claims.repository_owner)을 통해 테넌트 ID를 제한해야 합니다. OAuth 호출자는 oauth_scope가 workspace:developer 또는 workspace:inference인 규칙만 관리할 수 있으며, 다른 범위는 Console 세션이 필요합니다.

Headers
"anthropic-beta": optional array of string

Optional header to specify the beta version(s) you want to use.

To use multiple betas, use a comma separated list like beta1,beta2 or specify the header multiple times for each beta.

Body
issuer_id: string

Tagged ID of the federation issuer.

match: object{ audience, claims, condition, subject_prefix }

Conditions the verified JWT must satisfy for this rule to apply. At least one of subject_prefix (other than a wildcard-only value like *), claims, or condition is required; audience alone is not sufficient.

audience: optional string or null

Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.

maxLength1024
claims: optional map[string] or null

Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.

condition: optional string or null

CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.

maxLength4096
subject_prefix: optional string or null

Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.

maxLength1024
name: string

Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

maxLength255
minLength1
oauth_scope: string

Space-separated OAuth scopes. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

minLength1
target: object{ service_account_id, type, service_account_name }

Identity that tokens minted via this rule act as. Currently always a service_account target.

service_account_id: string

Tagged ID of the service account to mint tokens for.

type: "service_account"
service_account_name: optional string or null

Service account's display name at read time. Ignored on writes.

applies_to_all_workspaces: optional boolean

When true, enable this rule for every workspace in the org (including workspaces created later).

attributes: optional map[string] or null

CEL expressions {name: expr} extracting named values from claims. Not yet supported; any non-empty value is rejected with 400.

description: optional string or null

Optional free-text description.

maxLength2000
token_lifetime_seconds: optional number

Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

maximum86400
minimum60
workspace_id: optional string or null

Tagged ID of the workspace to enable this rule for. Required unless applies_to_all_workspaces is true. Additional workspaces can be added via the /federation_rules/{federation_rule_id}/workspaces sub-resource.

Returns
FederationRule object{ id, applies_to_all_workspaces, archived_at, 17 more }

Authorization rule binding an external OIDC identity to Anthropic.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

페더레이션 규칙 생성
cURL
curl https://api.anthropic.com/v1/organizations/federation_rules \
    -H 'Content-Type: application/json' \
    -H 'anthropic-version: 2023-06-01' \
    -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
    -d '{
          "issuer_id": "issuer_id",
          "match": {},
          "name": "x",
          "oauth_scope": "x",
          "target": {
            "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
            "type": "service_account"
          }
        }'
Returns Examples
Response 200
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}