Authorization rule binding an external OIDC identity to Anthropic.
Evaluates the match conditions and mints an OAuth access token for the
resolved target, scoped to a single workspace where the rule is enabled
(chosen by the caller at exchange time when the rule is enabled for more
than one). For rules enabled via workspace_ids or
applies_to_all_workspaces, the target service account must be a member
of that workspace (it is implicitly a member of the default workspace);
rules carrying only the legacy workspace_id binding do not enforce
this.
Does the incoming JWT qualify?
All populated fields must pass; omitted fields are skipped. At least one
of subject_prefix (other than a wildcard-only value like *), claims,
or condition is required; audience alone is not sufficient.
Exact match against the aud claim (any element if array). When omitted, the JWT's aud must still equal Anthropic's expected audience for the issuer; setting this field overrides that default.
Exact-match {claim: value} pairs against top-level claims. Only string-valued claims can be matched; use condition for non-string claims.
CEL expression over claims for logic the structural fields can't express. Must evaluate to a boolean and may reference only the claims variable; a constant-true expression (such as true) is rejected with 400.
Match the verified JWT sub claim. Exact match unless the value ends with *, in which case it is a prefix match. Example: repo:my-org/my-repo:ref:refs/heads/main.
When this workspace was enabled for the rule.
Tagged ID (user_... or svac_...) of the actor that enabled this workspace for the rule, if known.
Tagged ID of the federation rule.
Tagged ID of the workspace this rule is enabled for.
Workspace display name. Populated when listing; null in the enable response.
Bind to a fixed service account by ID.
Tagged ID of the service account to mint tokens for.
Service account's display name at read time. Ignored on writes.