Claude Platform Docs

Regras

Criar regra de federação
client.Organization.Federation.Rules.New(ctx, body) (*FederationRule, error)
POST/v1/organizations/federation_rules

Requer um token de acesso OAuth com o escopo org:admin, obtido via ant auth login --scope org:admin ou uma regra de federação de identidade de workload; chaves de Admin API não são aceitas. Consulte Gerenciar WIF com a Admin API.

Listar regras de federação
client.Organization.Federation.Rules.List(ctx, query) (*PageCursor[FederationRule], error)
GET/v1/organizations/federation_rules

Requer um token de acesso OAuth com o escopo org:admin, obtido via ant auth login --scope org:admin ou uma regra de federação de identidade de workload; chaves de Admin API não são aceitas. Consulte Gerenciar WIF com a Admin API.

Obter regra de federação
client.Organization.Federation.Rules.Get(ctx, federationRuleID) (*FederationRule, error)
GET/v1/organizations/federation_rules/{federation_rule_id}

Requer um token de acesso OAuth com o escopo org:admin, obtido via ant auth login --scope org:admin ou uma regra de federação de identidade de workload; chaves de Admin API não são aceitas. Consulte Gerenciar WIF com a Admin API.

Atualizar regra de federação
client.Organization.Federation.Rules.Update(ctx, federationRuleID, body) (*FederationRule, error)
POST/v1/organizations/federation_rules/{federation_rule_id}

Requer um token de acesso OAuth com o escopo org:admin, obtido via ant auth login --scope org:admin ou uma regra de federação de identidade de workload; chaves de Admin API não são aceitas. Consulte Gerenciar WIF com a Admin API.

Arquivar regra de federação
client.Organization.Federation.Rules.Archive(ctx, federationRuleID) (*FederationRule, error)
POST/v1/organizations/federation_rules/{federation_rule_id}/archive

Requer um token de acesso OAuth com o escopo org:admin, obtido via ant auth login --scope org:admin ou uma regra de federação de identidade de workload; chaves de Admin API não são aceitas. Consulte Gerenciar WIF com a Admin API.

Models
type FederationRule struct { Type: "federation_rule"; ID; AppliesToAllWorkspaces; /* 15 more */ }

Authorization rule binding an external OIDC identity to Anthropic.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

type FederationRuleMatch struct { Audience; Claims; Condition; SubjectPrefix }

Does the incoming JWT qualify?

All populated fields must pass; omitted fields are skipped. At least one of subject_prefix (other than a wildcard-only value like *), claims, or condition is required; audience alone is not sufficient.

Audience string Optional

Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.

maxLength1024
Claims map[string, string] Optional

Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.

Condition string Optional

CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.

maxLength4096
SubjectPrefix string Optional

Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.

maxLength1024
type FederationRuleWorkspace struct { Type: "federation_rule_workspace"; CreatedAt; CreatedByActorID; /* 3 more */ }
Type FederationRuleWorkspace
defaultfederation_rule_workspace
CreatedAt Time

When this workspace was enabled for the rule.

formatdate-time
CreatedByActorID string

Tagged ID (user_... or svac_...) of the actor that enabled this workspace for the rule, if known.

FederationRuleID string

Tagged ID of the federation rule.

WorkspaceID string

Tagged ID of the workspace this rule is enabled for.

WorkspaceName string

Workspace display name. Populated when listing; null in the enable response.

type ServiceAccountTarget struct { Type: "service_account"; ServiceAccountID; ServiceAccountName }

Bind to a fixed service account by ID.

Type ServiceAccount
ServiceAccountID string

Tagged ID of the service account to mint tokens for.

ServiceAccountName string Optional

Service account's display name at read time. Ignored on writes.

RegrasEspaços de trabalho

Adicionar workspace à regra de federação
client.Organization.Federation.Rules.Workspaces.Add(ctx, federationRuleID, body) (*FederationRuleWorkspace, error)
POST/v1/organizations/federation_rules/{federation_rule_id}/workspaces

Requer um token de acesso OAuth com o escopo org:admin, obtido via ant auth login --scope org:admin ou uma regra de federação de identidade de workload; chaves de Admin API não são aceitas. Consulte Gerenciar WIF com a Admin API.

Listar workspaces da regra de federação
client.Organization.Federation.Rules.Workspaces.List(ctx, federationRuleID, query) (*PageCursor[FederationRuleWorkspace], error)
GET/v1/organizations/federation_rules/{federation_rule_id}/workspaces

Requer um token de acesso OAuth com o escopo org:admin, obtido via ant auth login --scope org:admin ou uma regra de federação de identidade de workload; chaves de Admin API não são aceitas. Consulte Gerenciar WIF com a Admin API.

Remover workspace da regra de federação
client.Organization.Federation.Rules.Workspaces.Remove(ctx, workspaceID, body) (*OrganizationFederationRuleWorkspaceRemoveResponse, error)
DELETE/v1/organizations/federation_rules/{federation_rule_id}/workspaces/{workspace_id}

Requer um token de acesso OAuth com o escopo org:admin, obtido via ant auth login --scope org:admin ou uma regra de federação de identidade de workload; chaves de Admin API não são aceitas. Consulte Gerenciar WIF com a Admin API.