Claude Platform Docs

Criar regra de federação

FederationRule organization().federation().rules().create(params, requestOptions = RequestOptions.none())
POST/v1/organizations/federation_rules

Requer um token de acesso OAuth com o escopo org:admin, obtido via ant auth login --scope org:admin ou uma regra de federação de identidade de workload; chaves de Admin API não são aceitas. Consulte Gerenciar WIF com a Admin API.

Crie uma regra de federação pertencente à sua organização.

O emissor referenciado e a conta de serviço de destino já devem existir na mesma organização; referências inválidas são rejeitadas com um erro 400. A referência ao workspace é validada. A associação não é verificada na criação da regra: a troca de tokens resolve um único workspace habilitado por chamada e é rejeitada, a menos que a conta de serviço de destino seja membro desse workspace (ela é implicitamente membro do workspace padrão). Regras em emissores compartilhados conhecidos (GitHub Actions, GitLab, Buildkite, Terraform Cloud, Google) devem restringir a identidade do tenant por meio de uma claim portadora de identidade, um prefixo de subject que fixe o tenant (como repo:YOUR_ORG/...) ou uma condição CEL que referencie uma dessas claims de identidade (por exemplo, claims.repository_owner). Chamadores OAuth só podem gerenciar regras cujo oauth_scope seja workspace:developer ou workspace:inference; outros escopos exigem uma sessão do Console.

Parameters
RuleCreateParams params
String issuerId

Tagged ID of the federation issuer.

FederationRuleMatch match

Conditions the verified JWT must satisfy for this rule to apply. At least one of subject_prefix (other than a wildcard-only value like *), claims, or condition is required; audience alone is not sufficient.

String name

Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength1
maxLength255
String oauthScope

Space-separated OAuth scopes. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

minLength1
ServiceAccountTarget target

Identity that tokens minted via this rule act as. Currently always a service_account target.

Optional<Boolean> appliesToAllWorkspaces

When true, enable this rule for every workspace in the org (including workspaces created later).

Optional<String> description

Optional free-text description.

maxLength2000
Optional<Long> tokenLifetimeSeconds

Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

minimum60
maximum86400
Optional<String> workspaceId

Tagged ID of the workspace to enable this rule for. Required unless applies_to_all_workspaces is true. Additional workspaces can be added via the /federation_rules/{federation_rule_id}/workspaces sub-resource.

Returns
class FederationRule { type = "federation_rule"; id; appliesToAllWorkspaces; /* 15 more */ }

Authorization rule binding an external OIDC identity to Anthropic.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

Criar regra de federação
package com.anthropic.example;

import com.anthropic.client.AnthropicClient;
import com.anthropic.client.okhttp.AnthropicOkHttpClient;
import com.anthropic.models.organization.federation.rules.FederationRule;
import com.anthropic.models.organization.federation.rules.FederationRuleMatch;
import com.anthropic.models.organization.federation.rules.RuleCreateParams;
import com.anthropic.models.organization.federation.rules.ServiceAccountTarget;

public final class Main {
    private Main() {}

    public static void main(String[] args) {
        AnthropicClient client = AnthropicOkHttpClient.fromEnv();

        RuleCreateParams params = RuleCreateParams.builder()
            .issuerId("issuer_id")
            .match(FederationRuleMatch.builder().build())
            .name("x")
            .oauthScope("x")
            .target(ServiceAccountTarget.of("svac_01SDCCSbTxrXDpWc1phhtcfK"))
            .build();
        FederationRule federationRule = client.organization().federation().rules().create(params);
    }
}
Returns Examples
Response 200
{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}