创建联合规则

client.Organization.Federation.Rules.New(ctx, body) (*FederationRule, error)

POST/v1/organizations/federation_rules

需要具有 org:admin 作用域的 OAuth 访问令牌，可通过 ant auth login --scope org:admin 或工作负载身份联合规则获取；不接受 Admin API 密钥。请参阅使用 Admin API 管理 WIF。

创建一个归您组织所有的联合规则。

所引用的颁发者和目标服务账号必须已存在于同一组织中；无效的引用将被拒绝并返回 400 错误。工作区引用会经过验证。创建规则时不检查成员资格：令牌交换在每次调用时解析单个已启用的工作区，除非目标服务账号是该工作区的成员（它隐式地是默认工作区的成员），否则将被拒绝。基于知名共享颁发者（GitHub Actions、GitLab、Buildkite、Terraform Cloud、Google）的规则必须通过承载身份的声明、固定租户的主体前缀（例如 repo:YOUR_ORG/...）或引用这些身份声明之一的 CEL 条件（例如 claims.repository_owner）来约束租户身份。OAuth 调用方只能管理 oauth_scope 为 workspace:developer 或 workspace:inference 的规则；其他作用域需要 Console 会话。

Parameters

body OrganizationFederationRuleNewParams

IssuerID string

Tagged ID of the federation issuer.

Match FederationRuleMatchParam

Conditions the verified JWT must satisfy for this rule to apply. At least one of subject_prefix (other than a wildcard-only value like *), claims, or condition is required; audience alone is not sufficient.

Name string

Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength1

maxLength255

OAuthScope string

Space-separated OAuth scopes. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

minLength1

Target ServiceAccountTargetParam

Identity that tokens minted via this rule act as. Currently always a service_account target.

AppliesToAllWorkspaces param.Opt[bool] Optional

When true, enable this rule for every workspace in the org (including workspaces created later).

Description param.Opt[string] Optional

Optional free-text description.

maxLength2000

TokenLifetimeSeconds param.Opt[int64] Optional

Lifetime in seconds for access tokens minted via this rule (60-86400). Defaults to 3600 (1h). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

minimum60

maximum86400

WorkspaceID param.Opt[string] Optional

Tagged ID of the workspace to enable this rule for. Required unless applies_to_all_workspaces is true. Additional workspaces can be added via the /federation_rules/{federation_rule_id}/workspaces sub-resource.

Returns

type FederationRule struct { Type: "federation_rule"; ID; AppliesToAllWorkspaces; /* 15 more */ }

Authorization rule binding an external OIDC identity to Anthropic.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

创建联合规则

package main

import (
	"context"
	"fmt"

	"github.com/anthropics/anthropic-sdk-go"
	"github.com/anthropics/anthropic-sdk-go/option"
)

func main() {
	client := anthropic.NewClient(
		option.WithAPIKey("my-anthropic-api-key"),
	)
	federationRule, err := client.Organization.Federation.Rules.New(context.TODO(), anthropic.OrganizationFederationRuleNewParams{
		IssuerID:   "issuer_id",
		Match:      anthropic.FederationRuleMatchParam{},
		Name:       "x",
		OAuthScope: "x",
		Target: anthropic.ServiceAccountTargetParam{
			ServiceAccountID: "svac_01SDCCSbTxrXDpWc1phhtcfK",
		},
	})
	if err != nil {
		panic(err.Error())
	}
	fmt.Printf("%+v\n", federationRule.ID)
}

Response 200

{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}

Returns Examples

Response 200

{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}